Develop, document and disseminate to the acquisition, information security and privacy and supply chain risk management personnel an agency or entity acquisition policy for systems that process, store or transmit CJI and its implementing procedures; designate information security and acquisition personnel to manage them; and review and update both after any security incident involving unauthorised access to CJI or the systems that handle it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.