Information security policies, standards and procedures define the control environment through a governance structure, describe required, expected and prohibited activities, guide users, developers, administrators and managers and tell them their responsibilities and the mechanisms for meeting them, cover the acquisition, design, configuration, operation, maintenance and audit of systems, describe the roles of the security function, lines of business and IT, and have a clear scope, sufficient detail, ordinary implementation and tool enforcement, delineated responsibilities, clear communication, employee certification of reading, flexibility, and annual board review and approval.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.