Where the organization's sole management system conforms to ISO/IEC 27001, that system can provide risk information and allow the organization to govern information risk, although other processes still underpin IT, financial, operational and other governance. The 7.3 governance processes stay the same; top management has governance duties that go beyond information security, corporate governance for example; aligning security objectives with those of the entity is simple because top management sets both; and where one role both governs and manages information security, suitable advice should make sure that responsibility for setting policy is kept properly apart from responsibility for carrying it out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.