Per 16 CFR 314.4(c): access controls + encryption + MFA + asset inventory + secure SDLC + change management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.