Before access or a change in authorisations the controller trains users on their duties under the Law, the Regulations and the procedure; for medium and high levels periodic training on the definitions document, the procedure and the security provisions is given at least every two years and promptly for new users in new roles.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.