The plan must require that the IAC cybersecurity monitoring program covers ingress and egress on IAC security conduits; at the Enhanced Profile it covers communications within intermediate zones and at the Extended Profile communications within Extended zones. The monitoring program itself must exist to detect security events, with consistent, risk-assessed and impact-informed criteria for what is monitored and how often.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.