The strategy is underpinned by an achievable, enforceable and auditable policy structure tailored to the organisation. Topics include organisational structure, asset identification and management, risk management, records retention, physical and environmental and personnel security, system security design, computer and network security, operational procedures, social engineering, acceptable use, training, third-party management, incident management, business continuity and disaster recovery (including pandemic response), remote and home working, and identification and handling of SNI. Policies reference relevant good practice from HMG, nuclear authorities and international bodies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.