Before going live equipment is configured to remove default accounts and passwords, apply minimum functionality (remove unneeded functions) and security by default (secure natural use, conscious acts to lower security), with virtual machines and hosts managed as securely as physical ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.