Development, security and operations work as one unit with security tests in the pipeline and timely patching; golden virtual machine and container images are patched, configured, scanned and stored in repositories and rebuilt on a schedule or in response to new vulnerabilities, with regression tests re-validated and vulnerable packages and libraries flagged and remediated; new builds take new connections while old ones drain, and open source dependencies are vetted for supply chain risk; serverless platforms can take over server maintenance; everything is configured and deployed with an infrastructure as code mindset using configuration management best practice and repositories free of keys, emails and passwords; key management uses provider or third-party services that meet the threat model (never home-written encryption), with separation of duties so no one person holds content, keys, policies and monitoring at once, periodic rotation of secrets, and a hardware or software secret store chosen to the threat model; and configuration drift, including small incremental changes, is monitored and only approved changes are allowed so the environment stays within its authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.