Risk identification draws on asset inventory and prioritisation information from the ASSET domain, such as IT and OT end of support, single points of failure and information assets' exposure to disclosure, tampering or destruction.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.