The governing body should call for one or more ISMSs to be designed in support of what the entity is trying to achieve. Each ISMS's objectives either match the entity's or differ in size, scale and structure while staying aligned, and each ISMS is designed to fit the entity's policies and processes, its risk management included. An ISMS may take over the governing body's risk assessment process so that risk is communicated clearly; where that process does not conform to ISO/IEC 27001, the ISMS should use another one and agree a way of reporting risk in terms the governing body can work with, or the governing body may change the entity's process so that it conforms. The governing body may task an ISMS with managing strategic risks such as reputational damage, losing intellectual property or losing money as a result of breaches of confidentiality, integrity or availability, and an ISMS can give it management information on risks to the entity and on how effective the ISMS is. The governing body should: approve setting up each ISMS; set out what every ISMS covers and, as a separate matter, the certification scope (the two may differ); give direction, covering objectives, requirements, roles and resources; decide what residual risk is acceptable or which treatments are appropriate; and give each ISMS channels for communication, and the authority to use them, with interested parties and with everyone within scope.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.