The program should include organization-wide record keeping of threats and concerning behavior so that every report under the policy is logged and tracked to identify, monitor and guide the response; central records matter most in large organizations, where offenders may move between roles, and may link to reporting channels. Report information should be kept strictly confidential and shared only on a compartmentalized need-to-know basis for incident management and follow-up by current and future management; paper files should be secured and strict security applied to electronic data. The organization should set retention practices that keep these records long enough for ongoing monitoring and follow-up.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.