The asset owner shall harden IACS components according to the supplier's guidance and the zone's requirements: unnecessary services disabled, default accounts changed, security settings applied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.