Identical in substance to IS.I.OR.245: archived and traceable records of any exemption approval and its assessment (5 years after loss of validity), contracts (5 years after amendment or termination), key processes, risks and treatments, reported incidents and vulnerabilities (5 years), and events pending reassessment (until reassessed); staff qualification and experience records for employment plus 3 years with access and copies for staff; formats specified in procedures; storage protected against damage, alteration and theft with classification, integrity, authenticity and authorised access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.