A capability, typically using tools such as a SIEM, is established and maintained to aggregate, correlate and analyse monitoring outputs and give a near-real-time understanding of the function's cybersecurity state.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.