Written procedures for key administration exist and are known, each administration activity is recorded, and the programme includes training of custodians within the yearly security training, one named person holding overall responsibility, background checks as far as local law permits, and withdrawal of access and privileges when staff change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.