For outsourced systems holding sensitive or classified information the provider controls access to the physical areas holding them, excludes other clients and outsiders and admits only personnel and visitors the Government has approved. Areas with different levels of physical control, set by the importance of the service and the sensitivity of the information, are worth implementing, with the physical and management controls documented and labelled. Where application systems share a rack, physical access approval is defined at equipment level rather than rack level, with individual key locks, account lockout and regular system log review to offset the sharing risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.