PAP systems should be put in, monitored, run and tested so they deter, delay and detect with the aim of denying malicious acts, allow a response to malicious acts and unwanted events, and support recovery, with performance measured against those aims. They should fit the organization's needs and be converged into its wider people, physical and electronic protection. To meet PAPMS requirements the PPS should give: protection in depth, so an adversary has to get past several components in turn, which demands more planning, lowers the odds of success and buys time to detect and respond; minimum consequence of component failure, through built-in contingency against a component failing or being defeated; and balanced protection, so different components, though physically or structurally unlike, each give an equivalent level of protection, balancing structural strength, safety and cost. Target attractiveness can be judged with the CRAVED factors (assets that are concealable, removable, available, valuable, enjoyable and disposable). Systems should meet performance specifications tied to clear operational requirements, with quantified specifications for how they are monitored, tested, run, maintained and replaced, and compliance with them should be shown when installation is complete.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.