The team makes explicit which groups it routinely interacts with and why (other incident response teams, vendors, law enforcement, the press, others such as research or the sponsor) without disclosing agreement details, and its reporting and disclosure policy says who receives its reports in each circumstance and whether it works through another CSIRT or directly with members of another constituency. It defines what information it will report or disclose, to whom and when (rather than treating everything as confidential and becoming a 'black hole'), states legal or sponsor constraints on disclosure, and says whether and how statistics are distributed; unique ticket numbers and explicit hand-off procedures support inter-team co-operation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.