The entity must document and implement an ICT project management policy for the acquisition, maintenance and where relevant development of ICT systems, covering project objectives, governance and roles, planning, timeframe and steps, project risk assessment, milestones, change management requirements, and testing of all requirements including security with an approval process before production deployment. The policy must bring in the information and expertise of the affected business areas, and require projects affecting critical or important functions, and their risks, to be reported to the management body individually or in aggregate according to importance and size, periodically and on events where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.