Non-binding VARA guidance for the framework: an organisation-wide security framework covering wallet and enterprise security, a secure development lifecycle with threat modelling and review gates, workforce controls (endpoint protection, awareness, background checks, joiner-leaver procedures, personal device standards), infrastructure inventories and change control, third-party provider due diligence and multi-vendor strategies; and technical standards for key generation (HSMs, validated routines, separation of duties, logging), controlled wallet creation, defence-in-depth key storage, smart contract review and audit, multi-signature schemes where required signers exceed half the signatories and are geographically distributed, multi-level transaction verification with anomaly halts, key compromise response, just-in-time key holder access, strong authentication, locked-down developer workstations, annual penetration tests and quarterly vulnerability assessments, secure media sanitisation and tamper-evident security logs kept at least one year.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.