Operators should develop and implement a security plan customized to the company, comprehensive in scope, systematic in development and risk-based. At a minimum the plan should: identify the primary and alternate security manager or officer responsible for executing and maintaining it; document the security policies and procedures, including the methodologies and timelines for criticality assessments, risk assessments and security vulnerability assessments (SVAs) where applicable; reference other company plans such as insider threat, business continuity and incident response and recovery; be reviewed annually and updated as required after assessment findings, major modifications to the system or its facilities, substantial changes in the operating environment or other significant changes; be protected from unauthorized access under company policy; and be provided to TSA for review on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.