Input: knowledge of the assessment and treatment processes the organisation defined under clauses 7 and 8. Action: document and retain information on them. Trigger: 27001 requires it. Output: what interested parties such as a certification body need, or what the organisation judges necessary for effective processes. For assessment it covers: the risk criteria (acceptance and assessment criteria); the reasoning for consistent, valid and comparable results; the identification method including how owners are identified; the analysis method (potential consequences, realistic likelihood, resulting level); and the method for comparing with criteria and prioritising for treatment. For treatment it describes how options are selected, how necessary controls are determined, how Annex A is used to check none was overlooked, how treatment plans are produced and how owners' approval is obtained.
This control maps to 27 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 27 it maps to, and the evidence behind each claim, over MCP and REST.