The competent authority must archive and keep traceable contracts for contracted activities (5 years after amendment or termination), records of its key processes and of its risks and treatment measures (at least 5 years) and records of events pending reassessment (until reassessed at the periodicity its procedure sets); keep qualification and experience records of its information security staff for their service and 3 years after, with access and copies for staff; specify formats in its procedures; and store records protected against damage, alteration and theft, classified where required, with integrity, authenticity and authorised access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.