Sample risk sources for each domain of the 5.6 model; the held text opens 6.2.2.1, the sensing and controlling domain, with its first source, flaws in the software or firmware of a device or gateway, and the rest of that list and the sub-clauses for the other domains (user, physical entity, operations and management, resource access and interchange, application and service) are not held; their sub-numbering beyond 6.2.2.1 is not held either, so the six domains are carried on this one leaf. Each domain's sources are the elements within it that can give rise to risk per the 6.2.1 categories.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.