Input: documents on the assessment process, including assessment and acceptance criteria. Action: perform assessment per clause 7. Trigger: planned intervals or events. Output: evaluated risks. The process defined under 27001 6.1 is embedded in operations and run at intervals suited to the ISMS and when significant change is proposed or occurs, using the 6.1.2 a) criteria; after a significant change to the ISMS, its context or the threat landscape (a new kind of attack), the organisation decides whether an extra assessment is needed. Routine assessments follow business and budget calendars: where funding requests and procurement cycles apply, assessments are scheduled to produce treatment recommendations in time for funding, to be reassessed once budgets are allocated, and to come round again after recommendations are implemented following procurement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.