Decide what competence is needed by people working under the organization's control whose work affects security performance; make sure they have it through suitable education, training or experience; where needed, act to build it (training, mentoring, reassignment, hiring or contracting) and judge whether that action worked; and keep documented evidence of competence. Implementation points (general ISMS practice; the 27003 guidance text is not held): list the roles that affect security, define what each requires, compare with what holders have, and check the effect of any action rather than only that it took place.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.