The host operating system is configured with only the functions required and hardened, with unnecessary services and ports disabled, to limit attack surface and patching load. Security requirements are set for each component of the virtualisation solution, from hypervisor and host OS to guest operating systems, applications and storage, and each is hardened to policy and standard; host and guest operating systems are scanned regularly with vulnerability tools that cover the virtualisation technologies used; and configuration management procedures cover every security setting of physical and virtual machines.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.