The program must identify the entity's critical workers; allow a critical worker access to critical components only after being assessed suitable; and so far as reasonably practicable minimise or eliminate material risks from malicious or negligent employees or contractors and from off-boarding of outgoing employees and contractors. In adopting, reviewing or varying the program the entity must have regard to whether it lists the critical workers and describes the personnel risks that could have a relevant impact on the asset.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.