Resistance asks whether the product can withstand attacks. A measure relates attacks resisted to the attack model and the tests run against it. Resistance needs a threat model. Without one, a test is a tour and the result is a count of findings with no denominator. The model should name the attacker, the capability and the assets, and the tests should be traceable to it. A penetration test is one method; abuse-case testing, fuzzing and control tests are others. The measure should be dated and tied to a version, because resistance changes with every release and every new dependency.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.