Canada-specific control: unclassified telecommunications in secure facilities that process classified information must not pass sensitive audio when idle and must resist external control or activation, applying on-hook audio protection per CNSSI 5002 and 5006; unclassified telephone systems must resist technical exploitation with physical and software access controls on programming and data; specific requirements are on-hook protection using CNSSI 5006 equipment or disconnect devices or an equivalent CNSSI 5002 configuration, isolation through a computerized telephone system with configuration control and audit reports and no ability to keep handsets off-hook, administration equipment only in restricted areas (or CNSSI 5006 phones where that is impossible), no remote maintenance outside the facility, no speakerphones or audio conferencing unless CSE approves an exception, voicemail and unified messaging configured against unauthorized diagnostic access, and answering and fax machines without remote monitoring or programming features unless CSE approves; unclassified systems must be electrically and physically isolated from classified ones, and CNSSI 5000 applies to VoIP in zones processing classified information. No enhancements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.