The plan must require that communications and data flows inside each IAC security zone and across internal, intermediate and external conduits are catalogued with attributes sufficient for tracking and reporting, essential function dependencies, the purpose, identity, owner and location of external cyber assets for external conduit flows, and the approver of each flow; at the Enhanced Profile the catalogue records the security and operations approvers and the functions, ports, protocols and services required across external conduits.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.