Restrict the use of digital and non-digital media on agency systems approved for CJI through technical, physical or administrative controls (port disabling, ACLs, group policy, MDM, locked cages, removed drives, an electronic media policy), prohibit personally owned digital media devices on agency systems that handle CJI, and prohibit digital media devices with no identifiable owner.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.