When new systems are developed or existing ones changed, security requirements are defined clearly and applied, taking account of legal requirements, current vulnerabilities and confidentiality, integrity and availability.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.