The organisation establishes, implements and maintains programmes for reaching its objectives for security operations and for risk treatment, prioritised to control and treat the risks of its operations, subcontractors and supply chain. A formal, documented risk treatment process considers removing the risk source where possible, reducing likelihood or consequence, sharing or transferring risk, or retaining it by informed decision, with top management assessing the benefits and costs of the options and the effect on stakeholders and human rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.