The chief executive sets up and runs a reporting and decision-making structure so that management takes part in establishing and operating the information security and personal information protection management system: management's responsibilities and roles for reporting and decisions are documented, and reporting, review and approval procedures let management actively decide on security and privacy matters (policy changes, risk management, internal audit).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.