The FI must have a written set of security standards (secure configurations) for every system, must ensure every system conforms to them, and where a system cannot conform must institute controls to reduce the risk of the non-conformity. The FAQ points to CIS and NIST practice for the standards and to senior management dispensation with mitigating controls for non-conformance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.