The plan must require that the risks of nonlocal maintenance and diagnostic capabilities are identified and the capabilities approved; nonlocal maintenance documented with records reviewed and retained per classification and schedule; services performed from an asset and zone with security comparable to the one serviced; each activity approved and logged; tools approved and catalogued; strong authenticators used to establish sessions; sessions and connections terminated when work ends; and nonlocal maintenance accounts disabled after consecutive failed logons. At the Enhanced Profile the risks of the tools themselves are assessed, failed logons generate audit records and sessions end after inactivity; at the Extended Profile nonlocal interactive access into an intermediate zone uses two or more authentication factors, the intermediate zone authenticates every interactive session and the multi-factor service is hardened and kept separate from the external zone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.