A covered entity documents in writing all procedures taken to comply with Regulation 5.260 and their results, retains every record the section requires for at least five years from creation unless the Chair approves otherwise in writing, and provides any such record to the Board on request. IT MICS #54 adds that the risk assessment and incident reports, with supporting documentation, are available to internal and external auditors and Board personnel.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.