Guidance: the process and what it produces should be recorded and reported by suitable means, in order to communicate risk activity and results throughout the organization, inform decisions, improve risk management, and support interaction with stakeholders including those accountable for risk management. Decisions about creating, retaining and handling documented information should consider its use, its sensitivity and the context. Reporting is part of governance and should raise how well the organization talks with its stakeholders and help top management and oversight bodies meet their responsibilities; it should consider the different stakeholders and their information needs, the cost, frequency and timeliness of reporting, the method, and the relevance of the information to objectives and decisions.
This control maps to 9 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 9 it maps to, and the evidence behind each claim, over MCP and REST.