In planning the ISMS, take the issues of 4.1 and the requirements of 4.2 into account and identify which risks and opportunities have to be dealt with so the ISMS can reach its intended results, undesired effects are avoided or lessened, and improvement continues; then plan actions for them, how those actions are built into and carried out within ISMS processes, and how their effectiveness will be judged. Implementation points (general ISMS practice; the 27003 guidance text is not held): keep risks and opportunities affecting the management system itself, such as weak management support, missing skills or poor fit with business processes, separate from the information security risks handled in 6.1.2 and 6.1.3.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.