Governance should rest on what the entity is obliged to comply with and on decisions about risk that are specific to the entity; the level of security that is acceptable should follow the entity's risk appetite, taking into account risks such as losing competitive advantage, compliance and liability exposure, disruption to operations, damage to reputation and financial loss. The management of information security risk should be applied consistently throughout the entity, should cover the financial, operational and reputational effects of breaches and of failing to comply, and should form part of the entity's overall risk management rather than standing apart from it, for instance by mapping onto the entity's own method or by entering strategic information risks in the entity's risk register. Suitable resources for managing information risk should be assigned as part of governance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.