Isolate ICS networks from any untrusted networks, especially the Internet; lock down all unused ports and turn off all unused services. Allow real-time external connectivity only where there is a defined business or control requirement; use one-way optical separation (data diode) where one-way communication suffices, and a single restricted port if bidirectional communication is necessary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.