The organisation identifies what its relevant interested parties fundamentally require, together with the organisation's current compliance with them, including every reference document that sets security rules and controls applying within the assessment's scope, for example: the reference control set given in Annex A to ISO/IEC 27001:2022; further ISMS standards; sector standards such as financial or healthcare ones; applicable international or national regulation; internal security rules; security rules and controls in contracts or agreements; and controls put in place by earlier risk treatment. Any shortfall against these requirements is explained and justified, and the requirements with their compliance status feed the likelihood assessment and the risk treatment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.