Control: decide the security level for each of the business offerings among the services provided, tell customers about it before the service starts, and maintain and manage the services properly. Purpose: sound security management of service delivery. Guidance: for customers, define and state plainly for each service its security features, its service levels and what managing it requires, and run awareness work that helps users guard against unsolicited communications, cybercrime and malware. Consider: controls that satisfy the law, such as blocking unauthorised interception and securing interconnection; offering special service levels, essential communications in an emergency among them; controls specific to each service (for IP connection and data centre services, controls against unsolicited communications and DoS/DDoS and for technical vulnerabilities; for telephone and mobile services, handling essential communications, emergency priority calls and call congestion; for managed services, authentication, encryption and careful handling of privileged mode); strict controls keeping communications undisclosed, call details included, and protecting PII; and controls stopping maliciously altered URLs being shown, with the service suspended and the customer advised when this is detected. To keep services running: maintain transmission facilities properly and repair them quickly in an emergency; maintain switching facilities or watch their traffic continuously, switching to backup facilities or routes to avoid congestion; have ways to keep facilities working under DoS load; and manage Internet routing and control information such as DNS properly, deploying DNSSEC.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.