Before new activities are taken on, including investments, purchases, mergers, adopting new technology, outsourcing and contracting with outside suppliers, their effect on information security risk should be properly assessed. So that acquisitions best serve the entity's objectives, the governing body should see to it that information security is built into the processes the entity already runs: project management, procurement, spending, managing strategic risk, and complying with laws and regulations. Each ISMS's top management should set an information security strategy grounded in the organization's objectives, reconciling the entity's requirements with the organization's security requirements so as to meet what interested parties need now and as their needs change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.