Governance normally covers a whole legal entity, so it reaches past the ISMS scope; one entity can run several ISMSs, and one governing body can govern several. All four processes still apply, and one of three situations arises depending on the relationship: an ISMS organization that runs on its own with its own business objectives aligns its security objectives with them; one that carries responsibility for one or more of the parent's business objectives aligns with those of the parent; and one given responsibility, for the parent, for a particular part of information security risk has its security objectives set by the parent. The people forming each ISMS's top management may coincide with the governing body, overlap with it, or be entirely different; Figure B.1 settles who counts as a member of the governing body and who as an interested party.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.