Every step of an incident investigation is done by people demonstrably competent for the tasks given to them, familiar and experienced enough with the tools, methods and techniques to work with little supervision, and able to see where their abilities end; when they reach that limit they refer the matter to a more senior or more competent person. A non-competent person can harm the results, delaying completion or producing wrong conclusions.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.