Programme success depends on sustained effort and oversight by many roles. Programme managers establish the information security governance structure and the security programme's goals and priorities, and agency heads fund the programme adequately, with resources that correctly pinpoint the kinds of information held and where they sit. The CIO promulgates the information security policy including disposition and sanitization and, as information custodian, ensures organisational and local sanitization requirements follow the guideline. The information system owner ensures maintenance and contractual agreements protect the confidentiality of system ISM and information in proportion to the impact of disclosure. The information owner or steward sees that service providers maintaining ISM on site are properly supervised and understands the sensitivity of the information and the basic sanitization requirements. The senior agency information security officer ensures the policy's disposition and sanitization requirements are implemented and exercised promptly across the organisation and has access to the technical basis and personnel to implement the procedures. The system security manager or officer coordinates day-to-day security for particular systems. The property management officer identifies and tracks sanitized ISM redistributed, donated or destroyed. The records management officer advises on retention requirements so that sanitization does not destroy records to be preserved. The privacy officer advises on disposition of privacy information and its media. Users know the confidentiality of the information they use and handle it properly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.