Development runs on systems separate from production with no development tools or data in production and no production data in development; R1 applies least privilege, R2 a recognised secure development methodology covering the lifecycle, secure coding, test data and code inspection, R3 security by design (identification, protection of information, audit trails), R4 controls test data; a further reinforcement requires a software component list.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.