Security covers confidentiality, integrity, non-repudiation, accountability, authenticity and resistance. The draft gives it six measure families. The six families are properties of the product, not a security programme. Confidentiality is about data not being disclosed to those without the right to see it. Integrity is about data not being changed improperly. Non-repudiation is about being unable to deny an action. Accountability is about being able to attribute an action to an entity. Authenticity is about proving an entity or a message is what it claims. Resistance is about withstanding attack. Each is measurable, and each needs evidence from the product and its operation. A penetration test result is evidence for resistance; it is not a measure of confidentiality or accountability. The draft keeps security inside the product quality model, which means the measures are about the product's behaviour, not about whether an organisation has a security management system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.