Management collects and compiles information on the IT environment as the first step in risk identification: IT systems inventories that show the infrastructure and the access and storage points of confidential information, the IT strategic plan, a comprehensive identification of connections with third parties and of all risky access points and connection types including LAN and WAN links, cloud, Wi-Fi and cellular, documented information flows including sensitive customer information, business continuity and disaster recovery plans and the further sources the booklet lists, so that risk exposures and deficiencies are visible.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.