Keep using equipment past the supplier's end-of-life date only where its configuration rarely changes and changes are reviewed, its interfaces are monitored or its compromise could not realistically affect the network, its exposure is minimal, a documented risk assessment is updated at least yearly, and a costed removal plan exists if the assessment no longer supports it; block and record over-the-air messages to your own SIMs except from allowed sources; and keep security configuration after upgrades or patches. Due: Tier 1 and Tier 2 by 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.