CA systems that are not operated wholly offline are hardened against insecure network access: services that are not needed or not secure, such as rlogin, rshell, telnet and ftp, are removed or disabled, ports that are not needed are closed, and each active service and port is documented. In particular: vendor default IDs are altered, removed or disabled except where a documented business need requires them, and defaults needed as object or process owners or for patching are switched on only when required and are otherwise blocked from logging in; every remaining vendor default, SNMP strings and passwords among them, is altered, removed or disabled ahead of the system joining the network.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.