Written policies at minimum on: risk management, internal control, internal audit, outsourcing, remuneration, and continuity. Reviewed at least annually (Article 41).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.