Identify the software authorised to execute on the system, apply a deny-all, permit-by-exception policy so only authorised software runs, and review and update the authorised list annually.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.