A process produces hardening guidelines for installation and maintenance covering integration with third-party components and with user applications through APIs and protocols, applying the defence in depth strategy, configuring each security option (its contribution, configurable and default values and their effect, how to set or remove them), security tools and utilities, periodic security maintenance, reporting incidents to the supplier and good administration practice; at survey they must show how to remove or disable unnecessary software, accounts and services.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.