The governing body should oversee how the organization manages risk (6.4), making sure that: every relevant kind of risk is seen as a whole; strategies are pursued within the agreed limits and tolerance; risk treatments fit the governance policies; risk is assessed, treated, monitored and reviewed as the framework requires; assessment is done consistently so risks can be compared and ranked; data analytics on risks and how they interact are effective; decision-making behaviour draws on assessment results and fits the policies; risk is reported and communicated well at every level; and risk management delivers the performance intended. In particular, it should satisfy itself that risk management is built into every activity, looking for evidence that the intended risk culture can be seen, that each part of the framework has been tailored and put in place, that resources for managing risk have been provided, and that authority, responsibility and accountability for risk have been allocated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.