The asset owner shall ensure remote access sessions are terminated when no longer needed, whether by timeout or manually, and that the ability to terminate them exists at the plant.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.