Input: assessment and treatment results. Action: document and retain them. Trigger: 27001 requires it. Output: documented results. Since assessments are due at planned intervals and on significant change, there is at least a schedule with evidence of assessments done to it, and for any proposed or actual change evidence of an assessment or an explanation of why the change is or is not significant. Assessment results record the identified risks with consequence and likelihood, the risk owners, the outcome of applying acceptance criteria and the treatment priority, with the rationale for risk decisions recommended for learning and improvement; treatment results record the necessary controls and, where available, evidence that they modify risk to meet the acceptance criteria.
This control maps to 27 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 27 it maps to, and the evidence behind each claim, over MCP and REST.