Implement a comprehensive, proportionate framework covering all relevant technologies, setting cybersecurity objectives and competency requirements for staff (and where relevant users) and policies, processes and controls, with defence in depth, informed by international standards; it must cover development, maintenance and testing of systems, operations, back-up, capacity and performance planning and availability testing, and be monitored, reviewed, updated and tested periodically in the light of emerging risks. A CISO is accountable for Parts I and III.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.