For medium and high security databases the controller has an internal or external audit by a trained auditor other than the Data Security Officer at least every 24 months, reporting conformity with the procedure and Regulations with recommendations; the controller reviews the report and considers updates; a high-level risk assessment that meets the report requirements may serve.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.