Because the castle-and-moat model does not protect cloud assets and the provider console is reachable from the internet, the agency secures resources within its virtual networks, takes a data-centric approach that protects data and assets before applications and services, segments data, applications and services for granular policy, scans new cloud and legacy networks for emerging vulnerabilities, and understands the limits of sensor placement: traffic dropped by the provider is invisible and provider mitigations may go unreported, so all inbound and outbound traffic is monitored at the tenant boundary, traffic between services and across peered networks is monitored, suspicious traffic raises alerts or is redirected to contained observation, virtualised sensors and logging scale with the infrastructure, and control of the content delivery network extends sensors beyond the agency perimeter.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.