At zone boundaries the control system shall monitor and control communications so that the compartments laid down in the zones and conduits model, drawn up from the risk assessment, are enforced. RE 1 requires deny-by-default with allow-by-exception, RE 2 island mode (the ability to disconnect from external networks), and RE 3 fail close on boundary protection failure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.