Once the network components are inventoried, management documents the network's baseline configuration with change review and approval, regularly assesses and documents compliance with the baseline against the board's risk appetite, applies configuration management and change control, documents traffic-permitting rules with the business need, periodically reviews device configurations with tools that detect unauthorised changes, closes unnecessary ports, deactivates insecure protocols and disables unneeded services, maps ports, protocols and services to the asset inventory and validates them by scanning, and applies the further network controls the booklet describes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.