Guidance: risk identification finds, recognizes and describes the risks that might help or prevent the organization achieving its objectives, and depends on relevant, appropriate and current information. A range of techniques can be used to find the uncertainties that affect objectives, and the following factors and the relationships between them deserve attention: risk sources, tangible or intangible; events and their causes; threats and opportunities; capabilities and vulnerabilities; shifts in the internal or external context; signs of risks that are emerging; what assets and resources there are and what they are worth; consequences and how they affect objectives; how far knowledge goes and how reliable information is; time-related factors; and the biases, assumptions and beliefs of the people involved. The organization should identify risks even when their sources lie outside its control, and should allow for more than one type of outcome with a variety of tangible and intangible consequences.
This control maps to 10 controls across 7 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 10 it maps to, and the evidence behind each claim, over MCP and REST.