Top management makes available what is essential for setting up, running, maintaining and improving the SOMS, including information, management tools, human resources with specialist skills, and finance; roles, responsibilities and authorities are defined, documented and communicated so that security operations are controlled, coordinated and supervised; and the organisation establishes teams for planning, security, incident management, response and recovery, each with its roles defined and with suitable authority, training and resources to deal with disruptive and undesirable events.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.