Keep the virtualisation fabric locked down, patched and supported and updatable without disruption; restrict host interfaces and admit only known hosts; require two-person sign-off for changes to network-defining databases; segregate traffic, limit workload exposure, encrypt data at rest and in transit where exposure exists; tag workloads and host pools with trust domains, never use containers to separate trust domains or network oversight functions, and keep orchestration and fabric administration as protected network oversight functions with minimal, separate privileged accounts (M13). By March 2028, hold secrets in hardware-backed storage, admit only cryptographically attested hosts, treat cut-throughs as no boundary, build and administer the fabric through automated verifiable processes, and alert immediately on manual administration (M19). Due: M13: Tier 1 and Tier 2 by 31 March 2027; M19: Tier 1 and Tier 2 by 31 March 2028.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.