A network device placed on a zone boundary must monitor and control communications at that boundary to enforce the zones and conduits model; RE 1 deny by default and allow by exception; RE 2 island mode, which the held NERC CIP comparative analysis quotes as blocking all communication across the control system's boundary; RE 3 fail close. The 4-2 text of the base requirement is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.