The CISO coordinates information security; backs the board and must be in a position to advise board members whether asked or not; turns the law and the entity's objectives into an information security policy; tells the board how line management is implementing that policy and complying with the BIO, so that the board can decide on treating information security risks with full knowledge; and is expressly not the one responsible for the information security that line management performs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.