The entity must specify, document and implement a physical and environmental security policy designed from the cyber threat landscape, the classification and the risk profile of assets. It must refer to the physical access part of the access control policy; protect premises, data centres and sensitive designated areas from attacks, accidents and environmental hazards in proportion to their importance and the criticality of what they host; secure ICT assets inside and outside the premises, including unattended assets; maintain assets and physical access control devices; and include clear desk and clear screen rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.