ISO/IEC 27001 requires control of changes to documented information (7.5.3) and of planned changes (8.1) and has Annex A controls on change; ISO/IEC 20000-1 (8.5.1) has extensive change management requirements the ISMS can adopt, including (8.5.1.3) decisions that consider the risks and the effect of a change on information security. To meet both, tasks, with checklists supporting impact assessment and post-implementation review, can be built into the integrated system on the ISO/IEC 20000-1 requirements, so that change management reviews every relevant security risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.