Management collects threat information from public and private sources as part of risk identification, and considers threat modelling to understand the nature, frequency and sophistication of threats, evaluate the institution's information security risks and apply the knowledge to the program, recognising that modelling will not anticipate every zero-day attack.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.