A responsible entity for an enhanced-class asset must establish and maintain a process in its CIRMP, so far as reasonably practicable, to minimise or eliminate the material risks of failure to patch or update operating or security systems in a timely manner; failure to replace legacy systems or adequately mitigate risks from components or technology that are redundant, unsupported, obsolete or discontinued; deployment or hosting of advanced, novel or emerging technology in a manner that could prejudice the asset's availability, integrity, reliability or confidentiality; and use of such technology against the asset; and for the annual report it has regard to whether the CIRMP contains appropriate measures against those risks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.