Before software, components or updates are used, their integrity and authenticity are checked and, where a supplier offers suitable evidence, their provenance verified; vendor advisories and threat intelligence keep the organisation aware of compromise affecting its suppliers, products and components, with responses made within timeframes that match the risk. Marked across the technical domains.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.