How the organization communicates about compliance, both internally and with outside parties. It is rated on two dimensions, each against the five-level scale in 5.2. Policy and procedures with conduct and culture: level 1, no procedures; level 2, incomplete procedures not implemented or implemented inconsistently; level 3, comprehensive procedures established that specify content, objectives, channels, timing and frequency, and language and format of communication, implemented in some business activities with documented information created and maintained; level 4, the level 3 procedures adjusted on past practice and implemented across the relevant business with documented information maintained and updated; level 5, the level 3 procedures fully embedded in organizational processes, continually monitored, evaluated, improved and adapted to changes in the internal and external context, with communication implemented fully under the procedures and attention to ensuring it is well received. Results and impacts: level 1, none; level 2, inconsistent; level 3, partial or loosely aligned to the organization's size, nature, complexity, context and compliance obligations; level 4, aligned and proactively managed; level 5, personnel and interested parties understand the organization's compliance expectations and can continuously obtain and accurately understand the latest compliance information, and personnel know their current compliance responsibilities, potential compliance risks, the noncompliance to be addressed and the current reporting channels.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.