The feasibility of segregating virtual machines is explored early: security zones are built by development stage (design, test, production), data importance, architecture layer (network, application, database, file) or system criticality, on separate physical servers where possible, and where mixing on one physical server cannot be avoided, isolation by virtual LAN, firewalls and intrusion detection and prevention is the countermeasure, with the connection to the internal network never lowering the existing security level. For more critical systems in private clouds a bare-metal (type 1) hypervisor is considered over a hosted (type 2) one, which inherits the host OS's vulnerabilities; this consideration is not tagged for public cloud, where even a bare-metal hypervisor may not suit critical or classified systems because the infrastructure is shared.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.