The board and employees regularly take courses on recognising and preventing cybersecurity risks and on what to do in an information security incident; board members also demonstrate that their knowledge and skills suffice to assess how information security risks affect the services and products the entity delivers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.