The plan must require an asset management plan for cataloguing, tracking and reporting the software the IAC cyber environment runs, with all software required for essential functions included, minimum attributes (responsibilities, manufacturer, version and revision, licence keys) and essential function dependencies; at the Enhanced Profile the catalogue records the owner, operating system and application manufacturer, product and version, software libraries and security services with versions, aggregated into a central repository.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.