The organisation identifies and documents the assumptions, constraints, priorities and trade-offs and risk tolerance that shape risk assessment, response and monitoring, distributes the results to defined personnel, and reviews and updates them at a set frequency. No enhancements. Deployed organisation-wide in the medium profile.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.