To shorten response and recovery after incidents and to cut human error, the entity keeps seven classes of documentation: a description of its information assets; the physical network topology; a logical diagram of information flows; the structured cabling records; technical, operational and user documentation for each system and component; instructions or internal rules for every administration, operation and maintenance activity on hardware and software; and internal rules for employees as users of the entity's services (workstations, network resources, passwords, internet, email, document systems, printing, removable media, portable recording devices and the like). Every document must carry identification (title, version, date, author, number), be kept current and reviewed at least annually, be approved by the head of the entity or an authorised person, be classified under Article 6, and be accessible only to those who need it for their duties.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.