Develop a system-level continuous monitoring strategy under the organization-level strategy that establishes the twenty system-level metrics the Policy names (account management, remote access monitoring, training records, configuration change control, configuration settings, user-installed software, incident monitoring, maintenance, physical access, environmental controls, delivery and removal, external personnel, external services, boundary protection, mobile code and system monitoring), sets ongoing monitoring and assessment frequencies, runs ongoing assessments and monitoring, correlates and analyses the results, responds to them, and reports the security and privacy status to the information security and privacy personnel and administrators annually, on security events and on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.