The plan must require that any removable media, whatever it holds or is for, is checked for threats, approved by authorised personnel and tagged or marked as approved before it is used with an IAC cyber asset in production, test or development, that any modification of its content voids the authorisation, and that CD and DVD media are treated as removable; at the Enhanced Profile processes protect approved media from later modification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.