Per SOCI Section 30AC: CIRMP. Requirements include (a) Critical Infrastructure Risk Management Program (CIRMP) covering cyber + personnel + physical + natural hazards + (b) Annual CIRMP Report to Board + Department + (c) board responsibility + senior management oversight + (d) cyber hazard responsibility per CIRMP Rules + (e) align to ISO 31000 + AS/NZS standards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.