A covered entity must train all workforce members on its privacy policies and procedures as necessary and appropriate for them to carry out their functions, and document that training, per 164.530(b).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.