The plan must require that communications at segregated environment boundaries are monitored and controlled; every asset inherits the profile requirements of its zone or conduit; zones communicate beyond their perimeter only through a conduit; assets reach external zones only through an external conduit; external conduits join only external and intermediate zones; intermediate zones use only external or intermediate conduits; intermediate conduits join only intermediate and internal zones; internal zones use only intermediate or internal conduits; and conduits deny any traffic with an intermediate zone not identified in the baseline as needed for essential functions. At the Enhanced Profile a conduit joining an Enhanced zone to any other zone explicitly denies all traffic not in the baseline, and conduits using external transport services address threats to availability, integrity and data security including man-in-the-middle and man-on-the-side attacks; at the Extended Profile the same explicit deny applies to conduits joining an Extended zone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.