Vendors should measure how well their processes for handling vulnerabilities are working, looking at: speed (how long it takes a vulnerability to pass through the process, aiming to shorten it, since fixing high-risk vulnerabilities quickly limits how far damage spreads); completeness (whether the fix deals with the root cause, which rests on the root cause analysis done during verification, accepting that a rushed, partial fix for an actively exploited vulnerability is only a stopgap); and how effective the fix proves after release (any adverse effects, how complete it was, and how widely it was adopted).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.