To decide which cybersecurity activities an item or component needs, it shall be analysed for three things: whether it is relevant to cybersecurity (Annex D offers a method), whether it is newly developed or reused, and whether tailoring under 6.4.3 applies. If it is not relevant, no cybersecurity plan is begun.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.