If the entity operates industrial control systems that are critical to the essential services it delivers, it must apply suitable protective measures to them in accordance with the regulatory requirements applicable to such systems, where those requirements apply. Annex 1's list and the sector's own rules supply the reference measures; the ordinance treats ICS as a distinct protection domain alongside IT.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.