All data is cataloged automatically as soon as it is created or ingested, in the same way in every environment; knowing all the data that exists is the foundation for every other control. Automation opportunities: create a catalog entry for every item of data that arrives in the cloud, whether migrated or newly created, in development, test and production and for online and archived data; generate evidence that the catalog is comprehensive; implement APIs and open metadata standards for sharing and catalog interoperability (the CDMC Information Model). Certification test steps: confirm the catalog exists; confirm metadata scanning is enabled on a recurring schedule; create a new asset and confirm an entry is generated; update an asset and confirm the entry is updated after the next scheduled scan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.