Control: where the organization places its own equipment inside a customer's premises to link with the customer's equipment, that equipment should be protected. Purpose: to provide equipment located at user sites securely. Guidance: equipment placed at the customer's site, a cabinet for example, should be robust and well protected from unauthorised access, and any tampering or attempted tampering should be detectable; the demarcation point and the customer-facing interface should be defined, so the equipment can readily be cut off from the customer when needed; and the equipment's status should be observable, or the equipment operable, from a remote location.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.