The ASMP is the end-to-end process by which security is managed application by application, a specialisation of the ISO/IEC 27005 risk management process. In each project it determines the application's requirements and environment, assesses its information security risks, derives the security requirements as the Targeted Level of Trust, initiates treatment by selecting ASCs for that level, treats risk by performing the ASCs' security activities and verification measurements, and measures residual risk as the Actual Level of Trust through the verification process. The application owner is accountable for specifying requirements, assessing risks and auditing security, the development team for building and keeping up the ANF and for provisioning and operating the application, and an auditor independent of the one who performed the security audit verifies that each step was performed correctly.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.