At least annually, a Group I covered entity engages an independent accountant or another independent entity with cybersecurity expertise to review its subsection 3 best practices and procedures and attest in writing that they comply with Regulation 5.260; the attestation and related documents are retained under subsection 6.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.