Written procedures for key administration exist and are known, every administration activity is documented, and the programme includes custodian training within the annual security training, one named person with overall responsibility, background checks, and removal of access and privileges when staff change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.