Risks should be identified when the project starts, at each progress evaluation and whenever a significant decision is taken, drawing on the originating organization's historical data and experience (8.3.1), and the results written into a risk management plan that forms part of the project management plan or is referred to by it. Risks from interactions of activities, processes and products between the originating organization, the project organization and interested parties also need to be found and written down. Identification should look beyond cost, time and product to quality, security, dependability, professional liability, IT, health, safety and the environment, bearing in mind statutory and regulatory requirements now and in future, and should consider how risks interact and what risks new technologies bring. Every identified risk that could have a significant impact should be recorded and given to a person who has the responsibility, authority and resources to manage it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.