Confidentiality asks whether data is disclosed only to those entitled to see it. A measure relates correctly restricted access to the access attempts or assets examined. The population is data assets and the people or systems entitled to them. A measure can be built from access tests, from the proportion of assets classified and protected, or from incidents of disclosure. The first is preventive and the others are retrospective. The draft keeps confidentiality at the product level, so the measure is about the product's behaviour, not about the organisation's access policy. A test should include the negative case: an unauthorised attempt that must fail.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.