Annex D is about when to take a measure. The same characteristic needs different evidence at requirements, design, code, test, acceptance and operation, and the annex maps the measures to those stages. The introduction names the lifecycle stages the draft is written for: requirements analysis, design specification, coding, testing through acceptance, and maintenance. The measure set has to be read against those stages, because a measure that is cheap at test can be impossible at operation and a measure that only exists at operation cannot inform a design decision. The annex is where the draft would set out which measures are available when. It matters commercially: a supplier answering a tender needs measures it can evidence before delivery, and an acquirer needs measures it can verify at acceptance and monitor in operation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.