Determine and document which changes are configuration-controlled, review proposed changes and approve or disapprove them with explicit security and privacy impact analysis, document the decisions, implement approved changes, retain change records for two years, monitor and review change activity, and oversee change control through configuration management personnel or a Configuration Control Board or Change Advisory Board that meets regularly or when hardware or software changes are needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.