The plan must require that maintenance of IAC cyber assets is documented with records reviewed periodically and retained per classification and schedule, performed to manufacturer, vendor or organisational specifications and approved beforehand, followed by verification that affected security controls still work before the asset returns to a production zone, with maintenance tools approved, maintenance personnel authorised, a list of authorised maintenance organisations and personnel kept, and media carrying diagnostic or test programs checked for threats before use. At the Enhanced Profile the data risk of removing an asset for off-site maintenance is identified and removal approved, unescorted maintenance personnel hold the needed access authorisations and authorised staff supervise those who do not; at the Extended Profile tools brought on site are inspected for improper modification before use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.