As a minimum, the organization's risk analysis draws on lessons from product recalls, product audits, returns and repairs from the field, complaints, scrap and rework. Documented information is kept as evidence of what the risk analysis found. As revised: SI 21 (July 2021): the threat of cyber-attacks on information technology systems becomes one of the minimum inputs to risk analysis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.