Before a telework or remote access solution is designed and deployed, the organisation builds threat models covering its remote access servers and whatever those servers expose, so that threats, their likelihood and their impact drive the choice of controls rather than being discovered after go-live.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.