Keep accurate records of all externally facing systems; security-test them at least every two years and after significant change; keep sensitive data and security critical functions off exposed edge equipment; separate the exposed edge physically and logically from security critical functions with protective boundaries; and ensure edge equipment cannot affect routing in the core. Due: Tier 1 by 31 March 2024; Tier 2 by 31 March 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.