The board, or a committee of it, requires a written report from executive management or its delegates at least once a year on how the Information Security Program stands overall and whether the Licensee is complying with the Act, and on material matters such as: risk assessment; decisions on risk management and control; arrangements with Third-Party Service Providers; what testing has shown; Cybersecurity Events or breaches and how management dealt with them; and proposed changes to the program.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.