Online certificate-processing components sit behind firewalls that deny every service not explicitly permitted, have unnecessary services, protocols and ports removed, fail closed and need an administrator to re-enable services, disable source routing, reject external traffic bearing internal addresses, alert the administrator in near real time to break-ins, low disk space and similar conditions, and are administered only through authenticated encrypted sessions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.