The plan must require that the risk assessment process covers the impact and likelihood of threats exploiting vulnerabilities to compromise availability, integrity or the security of data; consistent criteria for identifying impacts and for estimating likelihood; classification and protection of the impact and likelihood artefacts; a formal impact assessment process that identifies and categorises business objectives, the potential impacts on them and their severity levels, and maps those severity levels to the assurance levels used to select the API 1164 profile; and consultation of the stakeholders responsible for impact assessments through management of change on modifications that could alter business objective impact. At the Enhanced Profile the business objective impact assessment recurs periodically.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.