The designated provider must secure the owner's commitment to a biennial audit by an approved auditor of the CII's adherence to prescribed standards, an annual risk assessment in the prescribed form, reports to the provider within 30 days, and any re-audit, further assessment or additional audit the Commissioner directs through the provider; the provider must obtain each report and give the Commissioner a copy within 14 days of receiving it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.