All paths into the network are identified and the internal network restricted to authorised users; networks are separated physically or logically (DMZ, server farm, DB zone, development zone) by service, user group, asset importance and legal requirement with access control between zones; IP address assignment criteria apply (private addresses for servers such as databases that need no external connection); and links to remote IDCs, branches and agencies are protected in transit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.