How the organization carries out operational actions on its compliance risks and opportunities. It is rated on two dimensions, each against the five-level scale in 5.2. Policy and procedures with conduct and culture: level 1, no procedures; level 2, incomplete procedures not implemented or implemented inconsistently; level 3, comprehensive procedures established that specify operational controls linked to the relevant compliance obligations, applied consistently in internal processes and in externally provided and third-party processes, and a procedure for evaluating the controls' effectiveness, implemented in some business activities with documented information created and maintained; level 4, the level 3 procedures adjusted on past practice and implemented across the relevant business with documented information maintained and updated; level 5, the level 3 procedures fully embedded in organizational processes, continually monitored, evaluated, improved and adapted to changes in the internal and external context, with effectiveness evaluation done not only when noncompliance occurs and updated documented information showing processes run as planned. Results and impacts: level 1, none; level 2, inconsistent; level 3, partial or loosely aligned to the organization's size, nature, complexity, context and compliance obligations; level 4, aligned and proactively managed; level 5, the operational controls are implemented in business activities, actively managed and adapted to changes in context, in particular new or changed obligations and the related risk exposure, and their effectiveness has been evaluated with the measures adjusted on the results.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.