Maintain the plan per NIST SP 800-34 Rev 1 Section 3.7. Maintenance must (a) update plan content on triggers including system change + operational change + threat change + personnel change + lessons-learned + regulatory change, (b) review the plan at minimum annually even without trigger, (c) apply version control + change tracking + distribution management + access control to plan documentation including printed and electronic copies, (d) document plan approval per Section 3.7.1 by senior management + designated approving authority + with documented approval date + scope + signature, (e) distribute plan per Section 3.7.2 to all personnel with responsibilities + maintain distribution list + recall and replace obsolete versions + protect plan from unauthorised access (the plan itself contains information valuable to adversaries), (f) integrate plan updates with system change management + risk management + RMF Authorize step maintenance. Plan currency must be verifiable at any time by the system owner + authorising official + auditor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.