Providers of public and critical infrastructure such as energy and telecommunications are treated as third parties: the firm identifies the risk they carry, has processes for coping with a loss of those services, and updates them as needed to stay within its tolerance for disruption.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.