The management body must review the policy at least yearly and update it where needed, with changes implemented promptly in the relevant contracts and a documented implementation timeline. The policy must set or refer to a methodology for deciding which ICT services support critical or important functions and state when that assessment is done and reviewed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.