Testing should be done to make sure that as few undiscovered weaknesses and vulnerabilities as possible are left in the component, using functional testing, vulnerability scanning, fuzz testing and penetration testing; functions that are not needed may themselves harbour weaknesses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.