The agency evaluates the security and risk assessment, continuous monitoring and alerting, identity, DevSecOps integration and analytics capabilities each provider offers, never assuming they are secure or compliant, fills gaps from marketplace or commercial tools, brokers or managed services, weighs vendor lock-in against the benefits of native integration, uses capabilities that span accounts for a holistic view in multi-cloud environments, and chooses between independent capabilities (freedom of choice, but a third-party or home-built view is needed for holistic visibility) and integrated capabilities such as a SIEM (unified visibility across pipelines, less freedom), applying the shared responsibility model to integration across providers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.