CA systems not run exclusively offline are hardened against insecure network access: unnecessary or insecure services such as rlogin, rshell, telnet and ftp are removed or disabled, unnecessary ports disabled and every active service and port documented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.