The organization must make sure that everyone whose work could head off, bring about, respond to, lessen or suffer from significant hazards, threats and risks is competent by education, training or experience, and keep records of it; find out what training is needed, provide it and record it; keep procedures that make people aware of the significant hazards, threats, risks and impacts tied to their work, of the procedures for prevention, deterrence, mitigation, protecting themselves, evacuation, response, continuity and recovery, of why conformity matters, of their own roles and duties, of what follows if procedures are not followed and of the gains from better performance; and grow, champion and root a resilience management culture in its core values and governance, so that stakeholders know the policy and their part in the plans.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.