The organization shall base the identification, analysis and evaluation of the compliance risks it faces on a compliance risk assessment. Risks are found by matching its compliance obligations against its activities, products and services and the relevant parts of its operations, including risks arising from outsourced and third-party processes. The organization shall reassess compliance risks at regular intervals and whenever circumstances or context change significantly, and shall keep documented information on the assessment and on the actions taken on the risks.
This control maps to 6 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 6 it maps to, and the evidence behind each claim, over MCP and REST.