The organization must set up, operate and keep a formal, recorded assessment process that finds and values assets so as to reveal which activities, functions, services and products, which partnerships and supply chains and which stakeholder relationships are critical, and what disruptive incidents under the risk scenarios could do to them; identifies hazards and threats whether deliberate, accidental or natural; analyses risk, vulnerability, criticality and impact; analyses and ranks risk controls and treatments with what they cost; and settles which risks and impacts are significant. It must record this information, keep it current and, where fitting, confidential; reassess risks and impacts whenever the organization, its surroundings, procedures, functions, services, partnerships or supply chains change; set recovery time objectives and priorities; weigh the costs and benefits of options that lower risk and raise resilience; and make sure the significant risks and impacts steer the management system.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.