When planning the SOMS the organisation considers its context and requirements and determines the risks and opportunities it must address. It runs a formal, written risk assessment process over its security operations, relevant supply chain partners and subcontractors included, which identifies and weighs threats, weaknesses, consequences and risks to human rights at strategic, tactical and operational levels, analyses and evaluates them against the risk criteria, and keeps the resulting information current and secure, feeding it into objectives and treatment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.