Control: when security policies and operating procedures are updated or replaced, copies are kept for a stated, documented period. Guidance: past as well as current versions may need to be examined in customer disputes or an investigation by a PII protection authority; unless law or contract sets a period, keeping them at least five years is recommended.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.