Carried first-edition guidance. The CSC makes sure access to information in the service can be, and is, restricted under its access control policy, covering the services, their functions and the CSC data they hold; the CSP provides the access controls that allow that restriction. Parts of the environment such as hypervisor management and administrative consoles may need further access control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.