Response teams, or third parties, hold the hardware, software and licences needed, such as forensic and memory analysis tools, log parsers, write blockers, evidence bags and secure storage for chain of custody, with kits audited, refreshed after use and including journals and evidence forms. Dutyholders assure third-party tooling and record when law enforcement is contacted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.