An authority lasts no more than 30 days (or any other period the regulations set) and carries statutory conditions, which the person conducting the surveillance must not breach (s 30, maximum 50 penalty units): the surveillance supervisor and their supervisees give no one else access to the surveillance records, except that they may pass to the employer only the parts relevant to establishing an employee's involvement in the unlawful activity under the authority or to detecting other unlawful activity at the workplace or by an employee at work; within 3 months after the authority expires the supervisor erases or destroys, or has destroyed, all parts of the records not needed as evidence; if the employer takes or proposes detrimental action against an employee as a result (discrimination, disadvantage, adverse treatment, dismissal, prejudice in employment or a disciplinary proceeding), it gives the employee and their lawyer, on request and within a reasonable period, access to the parts of the record supplied to it that relate to the employee or the action; plus any conditions in the regulations or the authority.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.