The plan must require a risk-based asset management plan that prioritises resources with consistent criteria based on asset classification, criticality and business value, including dependencies and constraints of essential functions, and prioritises IAC cyber assets according to the documented criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.