Cloud, hypervisor, storage, network and system administrators each do their own job without being able to reach the sensitive data on what they manage; the split of duties is reviewed regularly and enforced strictly against external attacks such as advanced persistent threats and against insider abuse; and security administration has its own accounts, roles and people, kept apart from other administrative activity so that resources and audit trails are protected from unauthorised change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.