Security controls are applied to back-end systems to minimise the risk of insider attack (Table C1, threats 1.1 and 3.1: abuse of privileges by staff).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.