The organisation selects or defines a risk analysis process adequate for application-scale risks (organisational methods often do not scale down), documented with its activities and approved tools. It identifies the application's security exposure from vulnerabilities, threats and business impacts on the application's assets, prioritises the risks, draws on the business, technology and regulatory context of the application and its specifications from the first ASMP step, and outputs the list of security risks and the list of security requirements, suitable for selecting ASCs and thus the Targeted Level of Trust.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.