The department defines the methodology by which IT security threats and risks are assessed across the organisation, so that the departmental threat assessment and every IT project's threat and risk assessment activities use the same method. The output is the documented departmental IT security TRA methodology.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.