Because incidents will happen, incident information is collected as soon as possible and handled to support legal prosecution: for IaaS the mission owner or its CSSP runs the capture tools and coordinates with the CSP, and for PaaS and SaaS the CSP performs capture, preservation and protection in conjunction with the mission owner; the CSP provides an automated capability supporting incident capture and protection for its own infrastructure and for customer environments, with an interface available to the mission owner, which segregates government information from other customers' data, hashes captured data so changes can be detected, encrypts it to preserve confidentiality and integrity, and documents handling by every person who touches it (chain of custody) for law enforcement and counterintelligence; malicious software is handled under the stated rules and the forensic capability is demonstrated toward PA award. Mission owners reflect these requirements in the contract or SLA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.