Access to administer network, operating system, application and database security and system parameters is limited to IT personnel under supervision of IT supervisory or management staff; with no IT department, to supervisory or management personnel independent of the department using the system. (Group II ICP #20 adds a third option: non-independent supervisors if another department approves and each permission change is signed by both.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.