The information security policy is reviewed at least once a year, in step with the governance and planning and control cycles and with external developments, and adjusted where necessary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.