Cybersecurity requirements for protecting and handling the entity's data and information are identified, documented and approved according to the relevant legislative and regulatory requirements (ECC-2 removed the ownership, classification and privacy sub-items, which now sit with the National Data Management Office).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.