Third-party products and services forming the security architecture are chosen from the CCN catalogue of qualified ICT security products and services (CPSTIC) or, if none exists, certified per Article 19; a system providing a security service to a third party under the ENS must rely on qualified or certified products; R1 adds TEMPEST protection and R2 a software component list.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.