Verification is most effective when it is part of the larger development process rather than a gate at the end: secure design, coding standards, requirements and design review and other practices described in the NIST Secure Software Development Framework surround it and give it the references it needs to test against.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.