The FI should institute a process to assess and monitor the design and operating effectiveness of IT controls against identified risks; maintain a risk register to monitor and report technology risks, with significant risks monitored closely and reported to the board and senior management at a frequency commensurate with the risk; and develop technology risk metrics highlighting the information assets with the highest exposure, taking risk events, audit observations and regulatory requirements into account.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.