The policy must require a formal plan for managing IAC cyber vulnerabilities that uses the risk assessment process to decide responses to identified vulnerabilities, addresses vulnerabilities disclosed from outside (security researchers) and publicly disclosed vulnerabilities, addresses the use of automated scanning on production environments, and requires that stakeholders responsible for vulnerability management are consulted and informed through management of change on any physical or logical modification affecting cybersecurity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.