Carry out the impact assessment for every onboard system. For OT it feeds the ISM Code paragraph 10.4 list of equipment and systems whose sudden failure may cause hazardous situations; for IT it needs input from primary users (stowage, operations, commercial, finance) because losing IT can disrupt operations, compliance and even safety. The worked example of a power management system with SCADA shows sensor data rated high for integrity and availability but low for confidentiality, and statistical consumption data low throughout.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.