Agencies should set up gateway filters to catch: (a) incoming and outgoing email, attachments included, that holds any of: malicious code; material at odds with the agency's email policy; material that cannot be identified; file types that are deny listed or not authorised; and encrypted material, where it can neither be scanned for malicious code nor authenticated as sent by a trusted source; (b) email to aliases meant for internal use only whose source address lies outside the domain; and (c) every email coming in over an external connection with a source address using one of the agency's internal domain names.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.