The audit examines two aspects of each security measure: how it is designed and how it is applied in practice. The audit must also be shaped so that the operator bears no greater cost or disruption than the examination genuinely requires, which constrains sampling, site time and data requests.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.