The SyRS defines the system security requirements for both the facility housing the system and the system's own operational security, for example security and privacy requirements such as access limitations, log-on procedures and passwords, data protection and recovery methods, and safeguards against access, use, change, destruction or disclosure, whether accidental or malicious; in safety-critical embedded systems this can mean keeping a distributed record of data set history, giving particular functions to separate individual systems, or limiting which parts of the system may communicate (9.5.13). It defines the requirements for managing the information the system receives, generates or exports, such as the types and amounts to receive and store, proprietary or other protections, and backup and archiving (9.5.14).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.