The CIRP must provide for segregating the infected network or devices so malicious code does not spread, as necessary by removing infected devices from the network, segregating other devices that shared a network with them, preserving volatile memory by collecting a forensic memory image before powering off or moving a device, and isolating and securing all infected and potentially infected devices with clear labelling of affected equipment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.