ISO/IEC 27002:2022 control 5.2 applies, with telecommunications guidance: in appointing telecommunications engineers and other personnel, the organization should make sure they know enough about cybersecurity and information security, should tell them which security responsibilities and roles they are being given, and should have them formally accept those. Where cryptography is in use, dedicated crypto-custodian roles should exist, and whoever fills them should be trained properly to manage cryptographic material and to operate and safeguard cryptographic systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.