Input: the list of identified risks. Action: assign each risk to a risk owner. Trigger: it has not been done, or personnel change in the business area where the risks sit. Output: risk owners with their risks. Owners can be top management, the security committee, process, functional or asset owners, or department managers. The organisational process is used where it exists; otherwise the organisation sets criteria ensuring owners are accountable for and have authority over their risks, with a position that lets them actually use it, and understand the issues well enough to decide, for example on treatment. The level of risk and the asset concerned can guide the choice, and allocation happens within the assessment process.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.