Control access, under approved policies and procedures, to confidential system documentation so that nobody without authorisation can reach passwords, documentation, program source code or trade secrets. A small-system baseline control (Appendix K, category 4): protect PLC programs and administrative account inventories, use dedicated administrative accounts, disable orphaned accounts and make idle accounts dormant.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.