Managing systems or processing personal information from outside protected areas is prohibited in principle; where remote access is unavoidable (incident response, home working, collaboration) there is manager approval, designated terminals, limited scope and duration, stronger authentication, encrypted channels and endpoint security; internal remote operation is limited to specific terminals; and terminals used remotely to manage personal information processing systems are designated management terminals barred from other use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.