An Information Security Committee, overseen by the ITSC and composed as the ITSC decides with the CISO and business, IT and other representatives, is headed by someone from the risk management vertical; it develops and implements security and cyber policies, standards and procedures within risk appetite, approves and monitors security projects and awareness initiatives, reviews cyber incidents, IS audit observations and mitigation, and updates the ITSC and MD or CEO.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.