The asset owner shall assess IACS security risk, determine the mitigations needed to reduce it to a tolerable level, and implement them, using the 3-2 methodology of zones, conduits and target security levels where a system is designed or changed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.