The plan must require that each IAC cyber asset is set up to the baseline to provide only the capabilities required to support essential functions with all others disabled, and that management of change verifies this before an asset enters production; at the Extended Profile periodic reviews validate the configuration.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.