Security management establishes organizational, procedural and technical controls that keep regulated systems, data and records confidential, intact and available, including role-based access with segregation of duties, monitoring for vulnerabilities and intrusions, security incident handling and risk-based patching, continuously assessed against new threats. System administration tasks are identified, documented and controlled by procedures, administrators are trained with administrator privileges limited on the principle of least privilege and segregated from operational processing duties, and any non-standard activity goes through change and configuration management, as detailed in Appendices O11 and O12.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.