Capacity is planned with margin and technologies deployed to prevent known DoS and DDoS attacks; R1 adds detection and handling systems and reaction procedures including the communications provider; R2 prevents attacks from being launched from the organisation's own facilities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.