The asset owner must have policies and procedures that segment the IACS from non-IACS zones and keep any interconnection to the minimum that IACS operation needs and that stays within tolerable risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.