Provider tools are used to watch utilisation and health (CPU, memory, billing status, user activity) with notifications and automated remediation, integrated across vendors and clouds despite fragmentation, and the results feed continual posture improvement; the agency establishes and maintains incident response and recovery plans that account for native posture tooling and cloud capabilities (automated responses, replacing compromised resources, disabling instances to preserve forensics, access to archived instances, coordination with the provider's plans), prepares for the differences of cloud forensics without physical access, never assumes data is backed up because it is in the cloud, pre-positions robust backup policies and procedures, and audits and inspects the plans periodically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.