Requirement 0207 (Part Six: Physical, section 25.4.4 Physical Security Measures and Controls; applies to All entities; dated 31 October 2024; retained from Release 2025): The Accountable Authority or Chief Security Officer approves ongoing (or regular) access to entity facilities for people who are not directly engaged by the entity or covered by the terms of a contract or agreement, on the basis that the person has the required security clearance level for the Security Zone or Zones, and a business need supported by a business case and security risk assessment, which is reassessed at least every two years. For people not directly engaged or contracted, the Accountable Authority or CSO approves on clearance for the zones and a business case and risk assessment reassessed at least every two years.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.