The vendor is whoever carries responsibility for fixing vulnerabilities in a product or service, which in practice may be the party that develops, maintains, produces, manufactures, supplies, installs or provides it (3.4). In disclosure the vendor takes in reports (clause 6), handles them under ISO/IEC 30111, publishes advisories (clause 7), coordinates with others (clause 8) and publishes a disclosure policy (clause 9); for other vendors' products the same organization can itself act as reporter, user or coordinator (8.2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.