The team must have a policy on the methods of secure and verifiable communication it uses with other teams and constituents; the template includes its public keys or pointers with fingerprints, guidance on checking authenticity and on reporting corrupted information. As a minimum each team should, where possible, have a PGP key (other mechanisms such as S/MIME as needed), encrypt sensitive information where possible, sign correspondence, respect local encryption laws, and may keep secret authentication data (agreed passwords or phrases) for telephone or fax, whose existence but never value may be published.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.