The risk assessment is written and includes criteria for evaluating and categorising the identified security risks and threats, criteria for assessing the confidentiality, integrity and availability of the institution's information systems and customer information including the adequacy of existing controls against the identified risks, and requirements describing how identified risks will be mitigated or accepted and how the program will address them. Not required of institutions holding information on fewer than 5,000 consumers (314.6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.