The plan must require documented baseline configuration settings for IAC cyber assets and environments; consistent criteria for the capabilities needed to support essential functions (least functionality), included in the baseline; the interface characteristics, security requirements and nature of information for all ingress and egress communications; a non-production baseline managed separately from production; verification of an asset's configuration against the baseline before it enters service; and, for Baseline Profile environments, every internal conduit between Baseline zones and external conduit to external zones, their security risks and the activities and outcomes of the customised Baseline controls. At the Enhanced Profile the baseline adds external transport services used, conduits between Enhanced zones, from Enhanced intermediate zones to external zones and between Enhanced and Baseline zones, their risks and the customised Enhanced controls; at the Extended Profile at least one previous baseline is kept for rollback and the baseline adds every conduit touching an Extended zone, their risks and the customised Extended controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.