For each server, network and security system operating system the permitted users, locations and means of access are defined and controlled; idle sessions time out automatically; services unrelated to the system's purpose are removed; and systems providing key services run on dedicated servers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.