A formal, repeated process identifies, records, categorises and classifies information and associated assets (information types, IT, OT, infrastructure, systems, business processes and components) by the impact of loss of confidentiality, integrity and availability, consistent with the SyAPs categorisation annexes, the NISR Classification Policy and the related TAGs. Classification decisions are approved by an appropriate person or body, and an inventory with owners, locations, third-party arrangements and metadata is maintained. Hard-copy SNI and computer systems that handle SNI are always in scope, and operational technology used with nuclear or other radioactive material is always considered. The result lets the dutyholder rank assets by importance to safe and secure operation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.