This process group covers how technology risk, compliance, security and continuity are governed together. It takes in regulatory and audit obligations, risk tolerance, ownership and roles, the identification and evaluation of technology risk, and the mitigation strategies chosen in response. It also covers security, privacy and data protection policies and the monitoring of physical, logical, application and network controls. It includes compliance assessments, external audit support, identity and access management, breach response and penetration testing. It ends with continuity planning, change control and recurring resilience exercises including provider arrangements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.