The plan must require a risk assessment, using the impact assessment, of the use of mobile code in an IAC cyber environment, approval by authorised personnel before any use, use only per vendor recommended practices, and monitoring of mobile code execution in production, test and development environments.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.