Development, acquisition and maintenance are integral to operations, and weaknesses in them lead to failures of confidentiality, integrity, availability and resilience; management determines which systems, products and services the entity provides, whether to develop or acquire them and how to maintain them, performs acquisition and procurement whichever route it takes, plans maintenance from the outset to sustain secure continuity of operations, and treats supply chain risk management as integral to acquisition.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.