Require the developer to perform configuration management through design, development, implementation, operation and disposal, to document, manage and control the integrity of changes to security configuration, network diagrams and hardware, software and firmware with access restrictions such as least privilege, to implement only organisation-approved changes, to document approved changes and their security and privacy impacts, and to track security flaws and their resolution and report them to the information security and acquisition personnel.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.