Key generation and other cryptographic operations must use dedicated cryptographic pseudo-random number generators; general-purpose library functions such as random() in programming languages must not be used because they rest on weak linear congruential generators. Generators should be tested with packages such as the NIST SP 800-22 statistical tests and Dieharder, and should follow ISO 28640:2010 and NIST SP 800-90A.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.