Security standards for hardware and software (operating systems, databases, network devices, endpoints) should set hardened configurations and be reviewed periodically, with a process to verify uniform application and to address deviations promptly. Endpoint protection combining behavioural and signature-based detection should counter malware delivered by links, websites, attachments or removable media, with signatures kept current and regular scanning; detection and response mechanisms should scan for indicators of compromise and monitor processes on systems and endpoints for anomalies; application whitelisting or similar measures should allow only authorised software; and BYOD should be allowed only after a comprehensive risk assessment and securing of the BYOD environment (Annex B).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.