The plan must require that all IAC data in transit is authorised, validated and protected according to its classification; that the risk to moving data that starts in, ends in or crosses Baseline Profile zones is identified; and that in-transit protections cover communications within a Baseline zone and ingress and egress across internal conduits between Baseline internal zones, intermediate conduits between a Baseline internal zone and an intermediate zone, and external conduits between a Baseline intermediate zone and an external zone. At the Enhanced Profile user sessions are classified and protected as data in transit, and the same risk identification and protections extend to Enhanced Profile zones, their internal, intermediate and external conduits and conduits joining them to Baseline zones; at the Extended Profile they extend likewise to Extended Profile zones and every conduit joining them to external, Baseline and Enhanced zones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.