Management maintains a secure operating environment through development, acquisition and maintenance whether the entity or a third party operates the system, using configuration management, access control, business continuity planning and testing and formal least-privilege policies, documented policies that communicate and implement the controls, periodic audits that validate them, identification of who may access development, test and production environments and under what conditions, authorisation procedures for granting and verifying access, defined access duration, segregation of development, test, QA and production with access controls for each, resilience built in, and the further controls the booklet lists.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.