Evaluate the cyber risk assessment process at least once a year against changes in the environment and improve it; evaluate the design and operating effectiveness of the cyber risk management framework at least once a year and improve it; and act, under the relevant procedures, on recommendations, findings and lessons from exercises, vulnerability assessments and penetration tests, audits, risk assessments and actual incidents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.