The plan must require a risk assessment, using the API 1164 impact assessment, of the risk to a zone's essential functions from automated vulnerability detection in production; approval by authorised personnel before any such use; use only per manufacturer, supplier and integrator recommended practices; a risk assessment of the risk to vulnerability lists; a risk assessment of any automated identification method before it runs in an active production segregated environment; and review and approval of that assessment's recommendations by authorised members of both the IAC operations and the control system cybersecurity organisations before implementation. At the Enhanced Profile the monitoring program runs automated vulnerability detection in the development or test environments that support production environments rated I2-Medium or higher.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.