Prevention and response mechanisms against malware are installed on workstations, servers and perimeter devices, external files are scanned, signatures kept current and real-time protection configured; R1 scans the whole system regularly, R2 checks critical functions at boot, R3 enforces application allow-listing and R4 uses endpoint detection and response (EDR).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.