CC2 - Communication and Information

CC2 - Communication and Information requires the entity to identify, capture, retain, and protect relevant information needed to support its system and service commitments. It mandates timely communication of policies, security incidents, and service changes to stakeholders, and ensures that information is accurate, complete, and accessible for monitoring and decision-making.