Baseline: documented recordkeeping policies for security information that specifically address protection of Sensitive Security Information under 49 CFR parts 15 and 1520, retaining until superseded the corporate security plan, criticality assessments, training records, drill and exercise reports, incident response plans and security testing and audits, and making them available to TSA on request. Enhanced: also retain SVAs and site-specific measures for critical facilities and make security records available to TSA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.