The head of each agency is responsible for providing information security protections commensurate with the risk and magnitude of the harm that unauthorised access, use, disclosure, disruption, modification or destruction would cause to information collected or maintained by or on behalf of the agency and to information systems used or operated by the agency or by a contractor or other organisation on its behalf.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.