Management implements controls aligned with the institution's operations and strategy that, based on the risk assessment, include patch management, asset and configuration management, vulnerability scanning and penetration testing, endpoint security, resilience controls, logging and monitoring and secure software development including third-party development, resources, training and testing them, applying risk-based controls to cybersecurity threats such as interconnectivity risk, reviewing and updating the controls as the environment changes, and may reference the NIST 800 series, COBIT, ITIL, the ISO 27000 series and industry sources.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.