Establish and provide to everyone needing system access the rules describing their responsibilities and expected behaviour for information and system use, security and privacy, obtain a documented acknowledgment before authorising access, review and update the rules at least annually, and require re-acknowledgment annually and when the rules change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.