Technology assets are under configuration management, with change detection techniques in place, modifications are reviewed and tested before reaching production, unauthorised or unexplained changes are addressed, integrity requirements decide who may modify information assets and information integrity is monitored, a process manages access to technology assets, and maintenance and repair (including remote maintenance) are timely, logged, done with approved and controlled tools and methods, and performed so as to prevent unauthorised access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.