Security plans and records, together with security measures, processes and procedures, shall be treated as sensitive security information, protected from access or disclosure without authority, and released only to people who need to know. Besides the relevant law enforcement officials or those they nominate, a person needs to know if they must see particular information to perform security tasks under the plan, are being trained to perform them, must see it to supervise others performing them, or act for a party given access under a contract on agreed terms. This protection does not stop the organization telling business partners and others about its security arrangements, and third-party certification or validation by government may remove the need for contractual access to the information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.