Where a significant risk to the security of the service remains despite the measures taken, the service provider must tell the subscribers concerned what the risk is, what appropriate measures they can take to protect themselves and the likely cost to them of those measures, free of any charge other than the subscriber's own cost of receiving or collecting the information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.