On information security matters in the agency, the CISO should have a direct reporting line to the agency head.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.