The organisation establishes, implements and maintains procedures for monitoring and reporting incidents, investigating them, taking disciplinary action and making remedies, and it reports to the client and the appropriate authorities, as legally required, incidents involving the use of force or weapons, casualties and injuries, abuse allegations, lost sensitive information or equipment, substance abuse and nonconformity with the law or the standard. Everyone working on its behalf is made aware of their responsibility and the mechanisms for reporting, and records of nonconformities and incidents are kept for at least seven years or longer where law or regulation requires.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.