Principle 7 expects resilient ICT and cyber security, with protection, detection, response and recovery programmes that are tested regularly, build in situational awareness and feed timely information into risk management and decision making in support of critical operations. A written ICT and cyber policy sets governance and oversight, who owns and answers for each risk, the security measures (access control, protection of critical information assets, identity management), the periodic evaluation and monitoring of cyber controls, and incident response with continuity and disaster recovery.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.