Cyber protection practices: access to physical and logical assets and facilities for core business lines and critical operations is restricted to authorised users, processes and devices and managed to the assessed risk of unauthorised access; cybersecurity awareness education goes especially to people, third-party staff included, who work in critical operations, and they are trained for their security duties; information and data are managed within appetite and tolerance to protect confidentiality, integrity and availability; security processes cover purpose, scope, roles, responsibilities, management commitment and coordination; data used in critical operations is encrypted, and data at rest and in transit is protected to its criticality and sensitivity; backups of critical data are made and tested regularly for completeness and reliability; critical assets are disposed of so that sensitive information cannot be recovered; configuration baselines carry resilience requirements and configuration changes cause minimal disruption; industrial control and information system components are maintained and repaired under policy; the architecture for critical operations builds in cyber resilience, is secure by design and allows for interdependency, interconnectivity, scale and complexity; acquisition, development, testing and integration processes carry resilience requirements through their lifecycles; components are upgraded or replaced before the developer, vendor or manufacturer stops supporting them; and technical security solutions are applied under policy, procedure and agreement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.