Input: all risk information from risk management. Action: keep risks, and the factors behind them, under monitoring and review (asset value, consequences, threats, vulnerabilities, likelihood) to spot contextual change early and keep the whole risk picture in view. Trigger: policy review or any detected change in the operating or threat environment. Output: management of risk kept aligned with business objectives and acceptance criteria. Treatment plans are used as a subject of the performance evaluation 27001 9.1 requires, starting from an information need (what top management wants to know, for example about its ability to defend against threats) and deriving the measurements and how to combine them. Because any of the scenarios, asset values, threats, weaknesses, likelihoods or consequences can shift without warning, monitoring is continual, helped by external threat and vulnerability services, and covers: new risk sources including newly reported IT vulnerabilities; new assets in scope; changes needed in asset values; vulnerabilities becoming exposed to new or returning threats; changes in how technologies are used that open new attack opportunities; changes in law and regulation; changes in risk appetite and in what is considered acceptable; and security incidents inside and outside the organisation. Low and retained risks are reviewed singly and in aggregate for accumulated consequence and treated under clause 8 if no longer acceptable; major changes prompt specific review, monitoring and treatment choices are revisited regularly, results feed other reviews, and all risks are reviewed regularly and on major change under 27001 clause 8.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.