The policy should define what is in scope (which products, services and systems) and what is not, and what testing activities the vendor does and does not accept from reporters.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.