A designated CII owner must develop and implement a cybersecurity policy that adequately addresses the infrastructure's risks in line with international best practice for its sector, approved by its board of directors, reviewed at least once a year against the risks and threats to its sector, addressing data protection consistently with the Data Protection Act 2012 (Act 843), and must implement any specific policy directive the Authority issues or approves.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.