Define and use a risk assessment process that sets and maintains risk criteria, namely acceptance criteria and criteria for carrying out assessments; gives consistent, valid and comparable results when repeated; finds the risks of losing confidentiality, integrity and availability of in-scope information and names an owner for each; analyses them by judging the possible consequences and the realistic likelihood and so the level of each risk; and evaluates them by comparing the analysis with the criteria and ranking them for treatment; the process itself is kept as documented information. Implementation points (general ISMS practice; the 27003 guidance text is not held): fix the criteria before assessing, involve the risk owners, record the basis for consequence and likelihood judgements, and hold the method steady so later assessments compare. ISO/IEC 27005 gives the detailed risk management guidance (held introduction of 27003).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.