The plan must require a risk assessment, using the impact assessment, of unauthorised personnel interactions, connections, devices and software in an IAC cyber environment and monitoring for them in production, test and development environments.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.