The processes used for testing the cyber security of a vehicle type through development and production. The Interpretation Document lists development-phase processes (rules, test strategy and planning, system design, software unit, hardware and integration testing, documenting results, handling vulnerabilities found, and justified test types such as requirement-based, interface, penetration, vulnerability scanning and fuzz testing) and production-phase processes confirming that produced items carry the specified controls and configuration; unfulfilled where a product is treated as a silver bullet, assurance methods are applied without understanding their limits, or assurance is assumed from the absence of known problems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.