Compliance with Chapter Two and with the standards the entity has adopted is checked through first-party internal audits organised by the entity (run by its own people or by an external party it engages); second-party audits by clients or suppliers and third-party audits by independent bodies are recommended but not mandatory. Internal audits follow BDS EN ISO 19011 and the requirements of BDS EN ISO/IEC 17020 and observe at least these rules: they run periodically and at least once a year; under documented, approved procedures, annual programmes and plans communicated to those responsible for the audited area; by people qualified in control with knowledge and experience in network and information security; with integrity, impartiality, professionalism, independence and confidentiality; nobody audits their own activity; findings are written up and passed to the employee in charge; each non-conformity is recorded in detail with the requirement, the condition found and a rectification deadline; and results are classified TLP-AMBER. The entity provides audit results to the national competent authority under Article 16(5) of the Cybersecurity Act.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.