After identification and characterisation, dutyholders put in place a CPS that is informed by risk, kept up to date and managed actively so that it meets the required outcome under the categorisation and outcome tables (SyAPs paragraph 192), integrating security into the design, implementation, operation and maintenance of operational and information technology so that it is secure and resilient to cyber threats. The published TAG set referenced as 7.3 is not listed by ONR, so this leaf rests on the SyAPs text alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.