The first step is to classify the environments the hosts run in. Standalone or small office hosts are generally not feasible because they lack central management; hosts in specialised security-limited functionality environments are strong candidates because of the risks they face; and for ordinary managed environments the organisation performs a risk assessment to decide whether the security gain outweighs the operational impact, recognising that dedicated trained staff will be needed to run the solution, as with enterprise antivirus or intrusion detection.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.