The plan must require that production segregated environments contain no non-production assets or zones, that non-production environments protect all data and executables destined for production to the same extent as production, that non-production credentials are unique from production credentials, and that any conduit connecting production and non-production zones is secured as a production conduit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.