Identical in substance to IS.I.OR.220: detection measures that identify deviations from predetermined functional performance baselines and trigger warnings; response measures that activate predefined resources and courses of action, contain the spread of an attack and control the failure mode of the affected elements; recovery measures, including emergency measures, that remove or constrain the causing condition and reach a safe state within a predefined recovery time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.