For each business domain the department selects controls from the catalogue and tailors them to its business needs and objectives, guided by the threat assessment, the security approaches and enterprise architecture artefacts. Each profile documents the common controls deployed by the IT security function and those every system must implement, and records the business context: in-scope activities and needs, security categories, threat context, security approaches, and technical constraints or assumptions. Domain threat reports may refine threats; the suggested profiles of Annex 4 may be used as a starting point.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.