The organisation must identify all its elements exposed to information security risk (activities, facilities, resources, the services it operates, provides, receives or maintains, and the supporting equipment, systems, data and information) and its interfaces with other organisations, identify for them the risks with a potential impact on aviation safety, assign each a level on its own classification weighing the potential of occurrence of the threat scenario and the severity of the safety consequences (informed by information from interfacing organisations for comparability), link each risk to its element or interface, and decide whether it is acceptable or must be treated under 210 taking into account whether it has a structured and repeatable operational risk management process; the assessment is reviewed and updated on changes to elements, interfaces or communicated risks, changes in the information or knowledge used, and lessons from incidents. Unlike IS.I.OR.205 there is no services-impact derogation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.