Every security audit comprises at minimum four components: examination of relevant documentation; interviews with the personnel concerned; technical checks of systems and network segments; and, where needed, inspection of premises. The interviews, technical checks and premises inspection are carried out at the operator's site unless particular reasons argue otherwise. The general advice expects both technical and non-technical elements, such as review of the operator's digital environment, internal rules and ways of working, outsourcing contracts and other documentation.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.