When information systems are introduced, developed or changed, a security and privacy review and acceptance procedure is set and followed; security requirements covering legal obligations and current vulnerabilities are defined clearly and built in from the design stage; and a secure coding standard is set and applied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.