Management of information security: the organisation assigns and coordinates security. Level 1 (a to d): named responsibility for information security, coordination of security activities across the organisation (including security in projects and HR responsibilities), a framework of security principles and direction, and security obligations flowing to external parties and suppliers. Level 2 adds (a) security objectives with plans to achieve them and (b) the security policy and organisation maintained as documented information; Level 3 is the same as Level 2.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.