A risk source is anything that, by itself or together with other things, is inherently capable of giving rise to risk (ISO 31000's term); when risk scenarios for an IoT system, application or service are worked out, the sources they contain should be identified thoroughly, with Annex A's monitoring camera as the worked example. The categories include, among others: (a) vulnerabilities of the system, application or service; (b) gaps in the knowledge and skills of those who provide or use it; (c) their human error; (d) people intending to attack it; (e) the quality of the system, application, service and their components; (f) outside systems and devices that attackers can misuse against it; (g) natural events such as lightning, flooding and earthquakes; and (h) weak organizational governance among the system's stakeholders. 6.2.2 gives samples per domain, 6.2.3 sources outside the domains, 6.2.4 privacy sources.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.