The plan must require that the asset management program addresses lifecycle disposal of IAC cyber assets no longer needed, that risk to their data at rest is identified, that information is permanently removed commensurate with risk regardless of previous production use, and that management of change addresses those data protection requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.