Carried from the first-edition CLD control on virtual machine hardening (the same guidance for both parties): cloud virtual machines are to be hardened to business need, and whoever configures one makes sure the right aspects are hardened, for example by opening only the ports, protocols and services needed, and that technical measures such as anti-malware and logging are in place on each machine.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.