Keep the control network logically separated from the corporate network, with as few connection points between the two as possible (ideally one), a stateful firewall between them that filters TCP and UDP ports, and DMZs for sharing data. A small-system baseline control (Appendix K, category 6), following NIST SP 800-82.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.