Providers using containers use only hardened images, hardened to National Checklist Program benchmarks under NIST SP 800-70 where available or to a provider-created, assessor-validated benchmark otherwise, with the final configurations validated against CM-6, SC-2, SC-3, SC-4, SC-6, SC-28 and SC-39 and the hardening pipeline validated by the assessor without validating every instance; build, test and deployment use automated orchestration tools validated against CA-2, CM-2, CM-3, SC-28, SI-3 and SI-7 with a mechanism that blocks non-compliant containers, pipeline components left of the production registry allowed outside the boundary and manual steps limited to quality review; every component of an image is scanned before deployment, ideally in the pipeline, the 30-day scanning window starts on deployment to the production registry, only containers from images scanned within 30 days may run in production, configuration changes and patches go to a replacement image rather than the running container, independent security sensors may run alongside production containers with sufficient privileges everywhere containers execute, and the registry is monitored per unique image with alarms or controls preventing deployment of unscanned images.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.