Before type approval the manufacturer performs appropriate and sufficient testing to verify the effectiveness of the security measures implemented. The Interpretation Document: results must be valid at the time of approval and may be confirmed by the technical service's own tests; evidence states what was tested and why, the method and why, who tested and their qualification, and the outcome with pass and fail criteria (ISO/SAE 21434 WP-10-07, WP-11-01).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.