The simplified framework must set ICT risk tolerance in line with risk appetite; identify and assess ICT risks; set mitigation strategies at least for risks outside tolerance and monitor their effectiveness; and assess ICT and information security risk arising from major changes to systems, services, processes or procedures, from security test results and after major incidents. Risk assessment must be done and documented periodically according to the risk profile; threats and vulnerabilities relevant to critical or important functions and assets must be monitored continuously and risk scenarios reviewed regularly; and alert thresholds and criteria must be set to trigger incident response.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.