How compliance obligations are identified and kept up to date. It is rated on two dimensions, each against the five-level scale in 5.2. Policy and procedures with conduct and culture: level 1, no procedures; level 2, incomplete procedures not implemented or implemented inconsistently; level 3, comprehensive procedures established that specify identification and analysis of interested parties' relevant requirements, the scope of compliance obligations, and documented information for identifying and updating them, implemented in some business activities with documented information created and maintained; level 4, the level 3 procedures adjusted on past practice and implemented across the relevant business with documented information maintained and updated; level 5, the level 3 procedures fully embedded in organizational processes, continually monitored, evaluated, improved and adapted to changes in the internal and external context, with the mandatory and voluntary obligations that arise from what the organization does, makes and provides identified, maintained and updated on the established schedule and on decisions to change or expand business, and documented information maintained to show external stakeholders the organization keeps pace. Results and impacts: level 1, none; level 2, inconsistent; level 3, partial or loosely aligned to the organization's size, nature, complexity, context and compliance obligations; level 4, aligned and proactively managed; level 5, mandatory and voluntary compliance obligations are determined and recorded against each of its operations, services, products and activities, on independent data analysis, with resources allocated for comprehensive and timely determination, regularly updated for new or changed obligations and their business impact, incorporated into the compliance risk assessment, and considered in changes or expansion of business.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.