Public-facing servers have protection measures, sit in a DMZ separated from the internal network behind firewalls, publish or store personal and important information only with approval under a posting procedure, and are checked periodically for exposure of important information on websites, with immediate blocking when found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.