The operator documents internal departmental responsibility for the ANSP in its manual and names a data security manager by position, who administers the whole program; changes to that manager are notified to the FAA in writing, typically within 5 business days; ultimate responsibility stays with the operator. The program must be comprehensive enough to keep data security protection sufficient against access by unauthorized devices or persons external to the aircraft, identify and assess threats specific to the operator's fleets, routes and maintenance practices and implement risk mitigation that keeps the aircraft airworthy, prevent inadvertent or malicious changes to aircraft networks, systems and software including those caused by maintenance, and prevent unauthorized access from sources on board; it must not include independent aircraft testing that tampers with the certified system, which could make the aircraft non-conforming and unairworthy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.