The organisation documents the requirements the technology must meet: security capabilities (authentication, cryptography, key management); performance; manageability, covering reliability, scalability and interoperability; how secure the technology itself is; usability; and maintainability, such as how updates are applied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.