Critical tasks require two or more people; development and operation, and authorisation and control, are separated where possible; R1 separates configuration from maintenance and audit from any other function; R2 strictly controls personal audit accounts; R3 limits access to security information to authorised administrators.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.