Senior management ensures that policies adopted by the board as governing principles, standards as mandatory criteria and procedures as detailed process descriptions are current, well documented and integrated with the information security strategy; management creates, documents, maintains and adheres to them to manage and control IT risk at a level of detail that lets the risk posture be monitored, and adherence is reviewed internally, by risk or compliance or by independent audit so that problems are found early.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.