The Qualified Individual reports in writing, regularly and at least annually, to the board of directors or equivalent governing body, or where none exists to a senior officer responsible for the program, on the overall status of the information security program and the institution's compliance with the rule, and on material matters including risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses, and recommendations for changes to the program. Not required of institutions holding information on fewer than 5,000 consumers (314.6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.