Vulnerability information passed between reporters, vendors and coordinators should be protected while in transit, the vendor offering secure options such as email encrypted with a published key or a web form served over an encrypted connection, so that report details do not reach attackers ahead of a fix; typical mechanisms named for this are TLS, S/MIME and OpenPGP. The CRA harmonized-standard draft treats the clause as its secure-communications requirement in the preparation phase, and 9.3.3 recommends that the policy tell reporters which options exist.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.