The plan must require that IAC data, digital and non-digital, is managed through information and document management processes, that risk to IAC information and documents is identified, and that retention and destruction requirements commensurate with risk are addressed, including for security and operational audit records.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.