Every authority carries statutory conditions: the surveillance supervisor gives no one access to covert surveillance records except that the employer may be given parts of a record for the authority's purpose or to identify or detect other unlawful activity in a workplace; within 3 months after the authority expires, the supervisor erases or destroys all its covert records except those needed for investigative or evidentiary purposes; and the employer, when a worker asks in writing, lets the worker see whatever part of a covert surveillance record it intends to use as the basis for adverse action against them. An authority runs no longer than 30 days or a prescribed period (s 30).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.