Management educates users on their security roles and responsibilities through acceptable use policies, holds all employees, officers and contractors accountable for compliance with sanctions available, keeps training current on endpoint security, log-in and password practice, phishing and social engineering, data loss through email and removable media and social media disclosure, updates it as the risk environment changes, and collects signed acknowledgments of the acceptable use policy in the annual training program.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.