Applying ISO/IEC 27001:2013 to a community needs interpretation in three places. The organization that establishes, implements, maintains and improves the ISMS (27001, 4.4) is the community itself, whose members are themselves organizations (Figure 1). Where not all persons in a member may access shared information, only part of the member is within the community ISMS scope and the rest sees community information only when it is marked for wider release (Figure 2); where members run their own ISMS, processes falling in both scopes might face conflicting requirements, which can justify an exclusion from the member's ISMS scope (27001, 4.3). And the community's risk assessment process (27001, 6.1.2) must recognize that the impact of a risk differs between members, so the methodology and criteria must handle non-uniform impact.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.