The organization should set and record objectives and targets, put them into effect and keep them current, so as to build physical asset protection across the organization and its supply chain, whether by avoiding, accepting or removing risk sources or by reducing likelihood or consequence. In setting and reviewing them it should take account of legal, regulatory and other requirements, its financial, operational and business needs, what its people and technology can do, and what interested parties think. Objectives should flow from the policy and the risk assessment and give the basis for choosing controls, weighing asset value, cost and benefit and the level of residual risk that can be tolerated; they should establish the cost and benefit of control options, rank control options and countermeasure needs, open chances to keep or lift performance, and be kept under review and updated as the risk picture changes. Targets should be set at a suitable level of detail, be specific, measurable, achievable, relevant and time-bound where practical, be made known to everyone concerned, whether employees, other staff or third parties such as contractors and supply chain partners, so each knows their own obligations, and be reassessed and amended when needed to stay consistent with the objectives.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.