The organisation in ISMS terms is whoever has its own functions, responsibilities, authorities and relationships to reach its objectives; it need not be a company or legal entity and can be part of one, such as an IT department. Risk appetite, the amount of risk the organisation will pursue or accept, differs widely between organisations with factors such as size, complexity and sector, and top management sets it and reviews it regularly. The role of risk owner is defined in terms of managing the identified risks, and risk owners hold fitting accountability and authority for them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.