Each entity writes and adopts its own network and information security policy and reviews it regularly, at least once a year, updating it when circumstances change. The policy states the entity's strategic security objectives and how it intends to meet them, aligned with the organisation's wider business and operating aims, its legal duties, contracts and the internal and external threats it faces now or expects. It must address, or incorporate by reference, the specific policies for information and communication systems: information exchange, mobile devices, remote working, use of encryption, identity and access control, building new systems, incident management, third-party relations, staff training and awareness, and any other topic relevant to the entity.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.