Where its Risk Assessment shows this to be appropriate, the Licensee applies access controls to Information Systems, among them controls that verify who users are and let in only Authorized Individuals, so that Nonpublic Information cannot be acquired without authorization.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.