An entity using internal testers must have a policy for managing them, measures so their use does not weaken general defence and resilience or drain ICT resources during the test, and measures giving them sufficient resources and capability. The policy must set criteria for suitability, competence and conflicts of interest and management responsibilities; be documented and reviewed periodically; require a test lead and at least two other members, all employed by the entity or an ICT intra-group provider for the preceding 12 months; and provide training in penetration and red team testing. Use of internal testers must be stated in the initiation information, the red team test report and the test summary report; testers employed by an intra-group provider count as internal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.