The FI should identify, define and document functional requirements together with key non-functional requirements such as performance, resilience and security controls, and, in setting security requirements, assess the threats and risks to the system and determine the level of security its business needs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.