Control the documented information the ISMS and the standard require so it can be reached and used at the point and time of need and is properly protected, for instance against disclosure, misuse or corruption; as applicable, manage its distribution, access (view only, or view and change), retrieval and use, its storage and preservation including legibility, version control of changes, and its retention and disposal; and identify and control outside documents the organization needs for planning and running the ISMS. Implementation points (general practice; the 27003 guidance text is not held): apply the organization's own security controls to its ISMS records and keep external sources such as contracts and legal texts current.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.