In the development or acquisition phase key designs are created or reviewed before development or purchase with early stakeholder involvement, design effort front-loaded for predictive and spread across phases for adaptive life cycles, acquired systems assessed for how far they can be configured, restored to a secure configuration and restricted in who may change configuration including customer-adjustable settings, security treated as a high priority with the IT security risk assessment from the feasibility study or one completed early in the phase used to design baseline controls, reasonably foreseeable threats identified for customer information, and the further design and security activities the booklet describes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.