Map data assets from authority and collection through use to destruction, including their legal authority and links to other assets and systems, and work through the data lifecycles (generally creation, collection, publication, uptake and use, sharing, and ending by archiving, destruction or return) to understand the agency's data ecosystem, with a plan to review it; understand clearly the authority under which each data collection is made (legislation, legal agreements or contracts, or operational necessity) and any restrictions, make it easily accessible to staff and refer to it in decisions on data use; and comply with legislation specific to the agency (for example the Australian Bureau of Statistics Act 1975, the Australian Institute of Health and Welfare Act 1987, the Census and Statistics Act 1905 or the Federal Court of Australia Act 1976).
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.