Policies, principles, standards, procedures and methodologies are reviewed and adjusted so that requirements arising from law, regulation and contract are dealt with and made known, taking into account whether to adopt industry standards, codes and guidance on good practice: they are reviewed and adjusted regularly for how well they secure compliance and address enterprise risk, drawing on internal and external experts where required, and all relevant personnel are told about new and changed requirements.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.