Configuration is managed continuously to preserve minimum functionality and least privilege, adapt to authorised needs, react to vulnerabilities and incidents, and be changed only by authorised staff; R1 maintains authorised baselines, verifies no unauthorised elements and keeps an authorised services list; R2 limits configuration responsibility to few administrators; R3 backs up configurations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.