An annual awareness and training plan (timing, duration, audience, content, method) is approved by management; all staff and outsiders in scope are trained at least annually and on major changes, new staff and contractors before starting work, and IT, security and privacy staff receive role-specific training; records are kept and effectiveness evaluated to inform the next plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.