Put in place business processes drawing on the listed parts of the NCSC Cyber Assessment Framework (Annex C); prioritise security changes and record postponements as business risk; keep restorable read-only backups; have exercised processes for incidents of varying severity; perform root-cause analysis of all security incidents escalated as appropriate, including to the board; share high-level lessons from significant incidents with other providers; and use lessons learned in new products and services. Due: Tier 1 by 31 March 2024; Tier 2 by 31 March 2025.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.