In deciding whether to adopt a program, the entity must have regard to whether it describes the outcome of identifying the operational context; describes the interdependencies between its relevant assets and other relevant critical infrastructure assets; identifies the positions responsible for developing and implementing the program and for reviewing it and keeping it current; gives contact details for those positions; contains a risk management methodology; and describes the circumstances in which the entity will review it. Civil penalty 200 penalty units (s 30AKA(1)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.