Determining facility criticality is the first step of security risk management and drives prioritization. Operators should evaluate every operating facility against the Section 5.2 criteria to determine or validate criticality, and should: conduct facility criticality assessments periodically, at intervals not exceeding 18 months, for all facilities; document the methodology and retain each assessment until no longer valid; conduct an SVA or equivalent (4.3) for facilities found critical; and maintain and secure the company's list of critical facilities. TSA reviews and evaluates the operator's list, and the two work towards concurrence on the facilities listed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.