The plan must require that protection technology effectiveness measurements are authorised, validated and given confidentiality, integrity and availability protection in line with their classification and that risk to them is identified. At the Enhanced Profile access to them follows the need-to-know principle with at least one authorised approver of access requests; need to know takes external parties into account, external parties with access are documented, and responsible disclosure requirements for supply chain vulnerability management are considered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.