Describe how cybersecurity information is communicated internally, including objectives and responsibilities and the thresholds at which monitored and investigated security events are treated as incidents needing response or remediation; guidance covers awareness programmes (social engineering, breach reporting), job descriptions, acknowledgement of codes and policies, confidentiality agreements, policy manuals, board communications and training, updating communications, and anonymous channels such as whistle-blower lines.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.