The plan must require that the authorisation privileges of accounts that reach IAC cyber assets are managed on every human-access interface, that privileges are managed by user role (system administrators, security administrators, technicians, nonlocal users), that least privilege governs provisioning, that segregation of duties between roles is defined and not violated by assigned privileges, and that compensating controls apply where segregation cannot be implemented for want of personnel.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.