The auditor examines the information security policy: appropriate to the organization's purpose, including or framing the objectives, committing to applicable requirements and to continual improvement, available as documented information, communicated within the organization and available to interested parties as appropriate, and whether personnel know it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.