Products and services depend on components from other vendors, so a vulnerability in a shared or third-party component can affect many vendors' products; the clause frames the supply chain tracking ISO/IEC 30111 6.5.3.8 and clause 8 require, where a vendor tracks the components used in its products and obtains and passes on vulnerability information along the chain.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.