The organisation establishes, implements and maintains an audit programme for its security operations management and conducts internal audits at planned intervals to establish whether the SOMS conforms to its own arrangements and to the standard and is effectively implemented and maintained; the programme sets how often audits run, by what methods, who is responsible, how they are planned and reported, with regard to the importance of the processes and the results of previous audits, defines criteria and scope, uses auditors who are objective and impartial, and reports results to relevant management; the management responsible for the audited area acts without undue delay to eliminate nonconformities and their causes, and follow-up verifies the actions taken.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.