The board sets the tone and direction for IT, understands IT activities and risks, and through itself or a committee reviews and approves an IT strategic plan aligned with the business strategy and carrying an information security strategy against ongoing and emerging threats including cyber, promotes IT governance, oversees the approval of third-party providers including their financial condition, resilience and security posture, oversees major projects, budgets, priorities and performance, oversees the adequacy of IT funding and personnel, approves policies for escalating and reporting significant security incidents to the board, steering committee, agencies and law enforcement, holds management accountable for identifying, measuring and mitigating IT risk, and provides independent, comprehensive IT audit coverage, delegating design and monitoring of specific activities to management or an IT steering committee of accountable members.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.