To collect and use information from monitoring, the employer must identify at least one of the six lawful bases suited to the processing; if the monitoring will, or probably will, pick up special category data, it must also identify a special category condition; and the monitoring must be lawful in the general sense, so other relevant laws should be considered. Monitoring all email traffic can pick up union or occupational health correspondence and so needs a condition; monitoring transactions for fraud may not.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.