This document is to be applied together with ISO/IEC 30111, and that pairing is mandatory (Figure 1). The division of labour: this document covers what a vendor builds into its ordinary business processes for the two outward-facing moments, taking in reports of possible vulnerabilities from people and organizations outside it, and getting remediation information to the users affected; it governs the vendor-reporter interface. ISO/IEC 30111 covers the work inside the vendor, triaging, investigating and fixing, wherever the report came from, including the vendor's own security, development and test teams. 5.3.2 adds the link to ISO/IEC 27002:2013, 12.6.1: without disclosure, users cannot manage technical vulnerabilities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.