Every piece of CSP and SI infrastructure that holds government or regulated sector data is penetration tested annually by an independent third party, and continuous automated vulnerability scanning runs on all internet-facing systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.