A risk assessment (risk analysis plus risk evaluation) is carried out for the system in scope: for every hazard or RAM equivalent it is decided, justified and recorded whether the risk is broadly acceptable (with expert judgement checking that the sum of broadly acceptable risks stays within a set share of the total risk); risks not broadly acceptable are analysed further by selecting a risk acceptance principle and applying it (code of practice, similar reference system, or explicit risk estimation, qualitative or quantitative) before risk evaluation against the criteria of that principle and the specification of safety requirements; tolerable safety risk depends on the risk acceptance criteria set by the legal framework or the railway duty holder under it.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.