Major incident types are identified with separate containment strategies and decision criteria, a defined risk appetite for incident handling, pre-agreed procedures such as network disconnection, a record of temporary changes, and monitoring for re-infection. Short-term containment limits damage quickly, for example isolating segments or failing over servers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.