Security is planned integrally, documenting facilities and access points, the system (equipment, internal networks, external connections, workstations and consoles), the lines of defence (interconnections, firewalls, DMZ, diverse technologies) and the identification and authentication system; R1 adds a security management system, R2 an ISMS with continual improvement and periodic approval, R3 internal technical controls validating input, output and intermediate data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.