The policy should state the secure communication options available to reporters, such as an encryption key for email or an encrypted form, so that reports are protected in transit (5.8.2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.