A top-level security and privacy policy grounds all activities, supported by guidelines, procedures and manuals setting methods, procedures and cycles; policies and implementing documents are approved by the chief executive or a delegate when made or amended, and the latest versions are given to staff in an understandable form.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.