The competent authority must set up, implement and maintain its own ISMS that establishes an information security policy on the potential impact of its information security risks on aviation safety; identifies and reviews risks (205); defines and implements treatment measures (210); detects events, identifies incidents with a potential safety impact and responds to and recovers from them (215); applies the contracting requirements (220), the personnel requirements (225) and the record-keeping requirements (230); monitors its own compliance with feedback of findings to the 225(a) person; protects the confidentiality of information it holds on the organisations it oversees and of the reports received through their external reporting schemes; notifies EASA of changes affecting its capacity to perform its tasks; and defines and implements procedures to share relevant information in a practical and timely manner with other competent authorities and agencies and with organisations subject to the Regulation to support their security risk assessments. It must run a continuous improvement process (235), document all key processes, procedures, roles and responsibilities with an amendment process, and size them to the nature and complexity of its activities on a risk assessment, integrated with existing management systems where it chooses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.