The entity must establish security zones appropriate to the classification of information handled, with facilities certified and accredited to the required standard.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.