The enterprise identifies and gathers the data it needs to identify, analyse and report I&T-related risk effectively. It sets up and maintains a method for collecting, classifying and analysing I&T risk data. It records significant data about its internal and external operating environment. A risk taxonomy provides consistent meanings for risk scenarios and for categories of impact and likelihood. Data about risk events that have affected, or might affect, the business are recorded against the taxonomy's impact categories, using related issues, incidents, problems and investigations. Historical risk data and loss experience from outside sources, industry peers and event logs are reviewed and analysed. Data on comparable classes of events are organised to bring out contributing factors, the conditions that were or were not present when events happened, and how these affected frequency and loss size. Periodic analysis of events and risk factors picks out new and emerging risk and the internal and external factors behind it.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.