The company always has appropriate and proportionate security measures in place so it is ready to respond under its plan, signed off by the senior person it appoints as responsible for security measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.