Guidance: planning is an ongoing process that determines and takes the actions needed for the system to achieve its intended outcomes and focuses resources where they matter most. The organization should have a process for deciding which risks and opportunities it must address, taking the context (4.1), the relevant needs and expectations including compliance obligations (4.2) and the scope as inputs. They come from three sources: compliance obligations, environmental aspects, and the other issues and requirements identified under 4.1 and 4.2; it may determine risks and opportunities per source, integrate the determination into its significance evaluation, or combine sources, using simple qualitative or full quantitative methods and existing business processes. Adverse effects can arise from minor aspects that damage reputation, significant aspects, non-fulfilment of obligations, environmental conditions such as climate-driven water scarcity, rapid expansion without competence, interested party views, and unintended consequences of actions; beneficial effects include new technology, resource conservation and defused opposition. The results feed planning action (6.1.4), objectives (6.2) and operational control (8.1), and inform competence, communication, monitoring, audit and emergency preparedness. Within the scope the organization should determine potential emergency situations, including those with environmental consequences.
This control maps to 5 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 5 it maps to, and the evidence behind each claim, over MCP and REST.