Management hardens commercial off-the-shelf applications and systems before deployment following vendor security recommendations: define the system's purpose and minimum requirements, install only the minimum hardware, software and services by a documented procedure, apply patches and the most secure current versions, deny all privileges and grant back the minimum, configure security settings, enable logging, hash key files, archive the configuration and checksums securely before deployment, and use secure replication for further systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.