System and data security should cover physical protection of the whole infrastructure (cameras, cabling, power) against tampering and theft, transmission over channels secure against interception, encryption, firewalls, anti-malware and intrusion detection, detection of failures and means to restore availability. Access control should secure premises where footage is viewed or stored, position monitors so only authorised operators see them, define and enforce procedures for granting, changing and revoking access, implement authentication and authorisation, record and regularly review user actions, and monitor access failures continuously.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.