IACS assets are to be grouped into zones kept logically or physically apart from business or enterprise system assets; the held IIoT paper reads this as extending to authentication domains, so that the IACS does not share, for example, the enterprise directory.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.