Conduct a risk assessment that identifies threats and vulnerabilities, determines the likelihood and magnitude of harm from unauthorised access, use, disclosure, disruption, modification or destruction of the system and its information, and determines the likelihood and impact of adverse effects on individuals from PII processing; integrate the results with organisation- and mission-level risk decisions, document them in a risk assessment report, review them at least quarterly, disseminate them to the risk assessment and security and privacy personnel, and update the assessment at least quarterly or on significant change to the system, its environment or other conditions affecting its security or privacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.