Development tooling (collaboration, requirement tracking, documentation, source control, linting and anti-pattern checks, pipeline security testing) is standardised across the agency; public-facing routine services (domains, DNS, HTTPS certificates) are centralised to keep an accurate web inventory, and internet-facing applications and APIs are protected through web application firewalls, API gateways and content delivery networks bought in bulk; and security services are deployed centrally to shrink the attack surface, above all centralised logging that survives local deletion, speeds investigation, meets the federal logging memorandum and enables cross-environment threat hunting, single sign-on identity brokering (with federated identity logging secured and a path to cloud as primary identity provider), low-friction SaaS onboarding piloted first, and authorisation services moving from roles to attributes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.