Control: An IoT security policy is set, approved by management, published and communicated to the relevant staff and outside parties, and reviewed at planned intervals or when something significant changes. Purpose: Management direction and support for IoT security within the developer or provider, in line with business requirements and what stakeholders expect. Audience: IoT service developer, IoT service provider. IoT domain marked in the held rendering: Operations and Management Domain (OMD).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.