At least every 2 years (or more often if directed) the owner must have an approved or appointed auditor audit the CII's compliance with the Act, prescribed technical or other standards, and applicable codes and standards of performance; at least annually it must conduct a cybersecurity risk assessment in the prescribed form; and within 30 days of completing either it must give the Commissioner a copy of the report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.