Intermediate control principles for it asset management (required, with baseline, of an AI whose inherent risk is medium). Systems approaching end of life are managed proactively (for example by replacement) to limit cyber risk; any change to baseline IT configurations needs a formal request, documented approval and an assessment of its security implications; in 2.0 accountability and a process keep the inventory updated on installation, removal and update of assets (marked intermediate in the 2.0 guide).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.