Risks differ in nature between service delivery and information security, and so can the criteria for evaluating and treating them, although the identification method can be shared. A risk found in one scope cannot be assumed relevant to the other, but every risk should be considered from both perspectives, in particular risks during service planning, risks from changes, risks to availability and risks to business continuity. Risk ownership differs too: an SMS may place it with the organisation, a customer, a supplier or another party, whereas in practice the organisation owns all information security risks in its ISMS although ISO/IEC 27001 requires only that an owner be identified. The ISO/IEC 20000-1 categories (risks to the organisation, to meeting service requirements and from the other parties taking part across the service life cycle) can also categorise information security risks. Mindful of differing risk criteria, the organisation should adopt one of three approaches: a single common approach that avoids duplication; separate approaches with terminology that keeps them apart; or a common approach for risks that affect both disciplines and separate methods for those specific to one. Separating shared from single-discipline risks can improve efficiency, and where risk assessment and treatment are critical, ISO/IEC 27001 should be implemented first for its more explicit requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.