Information from covert monitoring must be used only for its intended purpose, and other information should be disregarded and destroyed unless it reveals something no employer could reasonably ignore and there is no other way to deal with it; the number of people involved should be limited, access and disclosure rules set, a private investigator must be under a contract requiring lawful collection, and subject access requests may require disclosure, handled case by case.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.