The plan must require an IAC cyber asset management plan for tracking and reporting physical and virtual IAC cyber assets, consistent criteria for identifying physical assets, virtual assets treated as separate assets from their hosts, a minimum attribute set including a unique identifier (owner responsibilities, manufacturer, model, serial numbers) and the security zone or conduit each asset belongs to; at the Enhanced Profile the inventory identifies the asset owner.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.