Engage independent third-party for annual cybersecurity assessment per NGC 5.260(k) covering the cybersecurity programme effectiveness + risk assessment validation + control testing + compliance with NGC 5.260 + recommendations. Submit summary to NGCB upon request. Report cybersecurity programme status to Board of Directors or equivalent governing body at least annually including: programme status + material matters + risk assessment results + service provider arrangements + testing results + cyber attacks and response + recommendations for material changes. Maintain assessment reports + board minutes for at least 5 years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.