Organizations ensure security procedures are defined and followed, including logging of actions and access related to the management of security functions (Tables B3 and C2, 15.2: defined security procedures not followed).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.