The organisation must archive and keep traceable any 200(e) approval and its risk assessment (kept at least 5 years after the approval loses validity), contracts for contracted activities (5 years after amendment or termination), records of the key processes, of the risks and treatment measures and of incidents and vulnerabilities reported under 215 and 230 (at least 5 years), and records of events that may need reassessment to reveal undetected incidents or vulnerabilities (until reassessed at the periodicity its procedure defines); it must keep qualification and experience records of its own information security staff for their employment and at least 3 years after they leave, giving staff access and a copy on leaving; the record format is specified in its procedures and records are stored protected from damage, alteration and theft, identified by security classification where required, with integrity, authenticity and authorised access assured.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.