For every data asset holding sensitive data, compliance with data controls is monitored through metrics and automated notifications, the metrics being calculated from how far the other CDMC key controls are implemented. Automation opportunities: where evidence that controls exist can be gathered automatically, compute the compliance metrics automatically, and raise alerts to named stakeholders when a metric falls below its threshold. Certification test steps: confirm that controls on sensitive assets are continuously operating and tracked for all other key controls; produce a report or dashboard of the metrics; confirm an escalation threshold can be set per metric; degrade a key control deliberately so a metric leaves its limits and confirm the breach is reported automatically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.