The plan must require confidentiality or non-disclosure agreements scaled to risk, which are identified, documented and reviewed; information erased for good from IAC support assets once they are retired from use and from the possession of workers no longer required to perform IAC tasks (terminations, transfers, retirements); and identification of risk to data at rest on removable media used in the environment with permanent removal requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.