Include multifunction devices and special-purpose devices (video conferencing, IP phones, network cameras, access control, building management, environment monitoring) in the register; include third-party assets where needed on a risk basis; classify hardware and software taking account of critical operations' dependence on third parties; identify unmanaged personal devices and unapproved cloud use (shadow IT) and either bring them under management or stop them; and maintain a software bill of materials (SBOM) for in-house developed software and for services used where the provider supplies one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.