Determines whether awareness training is provided at the defined points and frequency, covers recognition and reporting of relevant threats including insider threat, and is updated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.