Management defines authorisation boundaries, in conjunction with the asset inventories, around the discrete technology assets that make up each information system, implements security controls within them, maintains multiple boundaries to limit the spread of malware after a breach, controls internal and external communications within and across boundaries and with third parties through means such as VPNs and demilitarised zones, and uses the boundaries to manage systems and facilities centrally and consistently with visibility for mitigation, maintenance and incident response.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.