The disclosure policy shall state how to contact the vendor to report a potential vulnerability, the preferred mechanism (an email address, a web form) being the one required element of a policy; the CRA harmonized-standard draft cites this clause as its contact-information requirement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.