At least annually, a Group I covered entity has its internal auditor, or another independent entity with cybersecurity expertise, perform and document observations, examinations and inquiries of employees to verify that the entity is following its subsection 3 best practices and procedures; the documents are retained under subsection 6. The same independent entity may also perform the subsection 5(c) review if different employees do each.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.