The asset owner shall have processes to discover security anomalies in the IACS, whether by monitoring, review or audit, so that deviations from the expected security state are found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.