Systems are designed to withstand incidents, appropriately segregated and with resource limits mitigated. Partially achieved: logical separation from business systems (for example a DMZ), no internet browsing or email, and resource limits identified. Achieved: separation by technical and physical means with independent infrastructure and administration, all resource limitations such as bandwidth and single paths mitigated, geographic weaknesses addressed through replication and diverse physical paths and providers, and these assessments kept current.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.