Opportunities to bring risk down to an acceptable level are managed together as a portfolio. The enterprise keeps an inventory of the control activities that mitigate risk and allow risk-taking within appetite and tolerance, classifies it, and maps it to specific risk statements and groupings of risk. It establishes whether each organisational entity monitors its risk and takes accountability for staying within the tolerance levels set for it individually and for the portfolio. It defines a balanced set of project proposals that lower risk or open up strategic opportunities, taking account of costs, benefits, the effect on the current risk profile and regulation.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.