Management hardens commercial off-the-shelf systems and components, whose default functionality and unnecessary services widen the attack surface, by consulting the provider's recommended controls and following a documented installation procedure that changes default passwords, installs the most secure current versions, configures security settings, enables logging and configures backups, mitigates the integration and interoperability risks of connecting COTS to existing systems, and manages the configuration and interface changes that modifications bring.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.