Each post handling information or services has security responsibilities based on the risk analysis and requirements (especially confidentiality) considered in selection, including verifying employment history, training and references lawfully; R1 requires personal security clearance for security and system administrators where the risk analysis or system requires it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.