Known weaknesses in the third-party components and services the software relies on are tracked and dealt with under Control Objective 10.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.