The enterprise confirms that its policies, principles, standards, procedures and methodologies meet legal, regulatory and contractual requirements: in every function, the organisation's policies, procedures, standards and methodologies are evaluated at regular intervals against the legal and regulatory requirements that bear on information and technology; gaps found in them are addressed promptly; business and IT processes and activities are evaluated periodically for adherence to the requirements that apply; repeated patterns of compliance failure are reviewed and the lessons assessed; and the policies, standards, procedures and methodologies, together with the processes tied to them, are improved using what the review and lessons show.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.