Cybersecurity specifications shall be set on the basis of the cybersecurity specification one level up in architectural abstraction, the cybersecurity controls chosen for implementation (for example a separate microcontroller with a hardware trust anchor) and the architectural design already in place. The specification describes the interfaces between sub-components and may take account of post-development consequences (storing keys, turning off debug interfaces, deleting personal data), of configuration and calibration parameters, and of the capabilities the controls need.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.