The agency works out with each provider who is responsible for data management and protection and applies protection at every stage (create, store, access, roam, share, retire), for every data type and in each state, whether at rest, moving or in use; it decides what needs protecting, how much protection applies and who controls sharing requests and access per provider; it sets policy for data when services are terminated and ensures that data, accounts and machine images, once deleted, are sanitised and cannot be reached; it protects intellectual property and configures key management, PKI or symmetric encryption correctly; it re-examines the contract and service levels when offerings change, avoiding redundant encryption where the provider's already meets compliance and privacy needs; and it chooses client-side or server-side encryption to its needs, follows secure key management, tests backups regularly, separates resources, manages account access and monitors all regions including unused ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.