The organization shall make sure that people given cybersecurity roles and responsibilities have the competence and awareness to carry them out, by means of a programme of competence building, awareness and training that covers the organizational rules and processes, related disciplines, knowledge of the domain, systems engineering, methods and tools, and known attacks together with their controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.