The plan must require that access by a user, device or process to a segregated environment and to its assets uses an authentication strength appropriate to the authorised interactions and to the essential functions controlled or supported, that authentication strength is consistent across assets in the same segregated environment, and that compensating controls apply where consistent strength cannot be implemented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.