Test cases are created from the functional specifications and requirements without reference to the code's internal structure, and include negative tests of invalid inputs and of what the software must not do, together with tests of denial of service and resource exhaustion. These tests are made more comprehensive in areas that general security principles or the threat model mark as security sensitive or critical.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.