An independent cybersecurity audit shall be carried out to decide whether the organization's processes meet the objectives of the standard. It may be combined with QMS audits, its independence may follow ISO 26262, the auditors may be internal or external, and it may be done periodically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.