Management allocates resources appropriately, placing specialists in the cybersecurity function and budgeting what is needed; sets a talent plan consistent with the basic policy (development, hiring and training plans) with a sustainable HR policy covering replacement of retirees, avoiding transfers that disrupt development of motivated staff and planning placements for the medium to long term, developing internal talent as well as hiring or using external people; takes part itself in training and exercises to gain the skills for cyber governance and culture; and secures, including through external resources, people who assess risks of new digital technology, plan cybersecurity strategy, run training, design and develop securely, collect threat and vulnerability information and remediate, monitor logs, respond to incidents, perform forensics, run vulnerability assessments and penetration tests, and audit cybersecurity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.