Application security assessments must be comprehensive, not confined to the OWASP top 10, drawing on other recognised standards as appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.