Information assets that the business can reach through approved methods are kept secure, whether held electronically (user applications, storage devices and portable media), on paper (source documents, output reports) or while in transit: use, distribution and physical access to information are limited in line with its classification; awareness and training on acceptable use are given; policies and procedures on security, acceptable use and data classification protect information the business controls; processes, tools and techniques give reasonable verification of compliance; and breaches and deviations are reported to the business and other stakeholders.
This control maps to 4 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 4 it maps to, and the evidence behind each claim, over MCP and REST.