The organization should carry out a cost-benefit analysis of candidate controls and countermeasures, for individual PPS and for integrated systems, measuring effectiveness and efficiency against the level of risk the organization has agreed to reduce, avoid or accept, how reliable the systems are and the time to implement the preferred option against alternatives, aiming for the best risk reduction at the best value. It should consider that: treatments are chosen on the risk reduction needed and the benefit each gives; asset value is compared with the cost of loss and lost production, counting lost output, lost capability and lost productivity during recovery or replacement; costs cover equipment and technology, opportunity, process impact, time, personnel and overall capability; the analysis rests on the risk assessment and covers tangible and intangible assets; combined treatments are judged by weighing design, technology, implementation, upkeep, replacement, training and administrative options against one another and the order applied; life-cycle costs are counted in full (design, implementation and deployment; purchase price; installation and operation, including utility, adaptability, reliability, scalability and redundancy; training; life expectancy; and life-cycle maintenance, including preventive maintenance, calibration, warranty, repair, replacement and disposal); and in-house and external staff costs for implementation, maintenance, monitoring and operation are included.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.