Controls are put in place to meet the control objectives, including network segregation to protect network integrity, protection of data at rest, in transit and against leaks, audit and log records defined, implemented and reviewed under policy, restriction of removable media, protection of communication and control networks, cybersecurity human resource practices such as screening and de-provisioning, and least-functionality access control such as allow-listing and deny-listing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.