Security controls are applied to back-end systems to prevent data breaches, OWASP giving examples (Table C1, threat 3.5: information breach by unintended sharing of data, for example admin errors or storing data in servers in garages).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.