The entity puts its information and its technology systems to work for enterprise risk management. Relevant information, structured and unstructured, from internal and external sources, is put to use in decision-making and must be available when needed and of high quality; data requirements are derived from information requirements and data sources are identified (board and management meetings, customer feedback, due diligence, email, government and industry data, social media, sensors); risk information is categorized in common risk categories or a risk taxonomy; data is managed to preserve its quality and allow exchange between technologies; technology supports the activities of enterprise risk management (artificial intelligence, analytics, visualization, automated monitoring) as well as the processing and reporting of data; and technologies are reviewed as requirements change with the business context and strategy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.