The business context is the inventory and documentation of every business process, standard and best practice adopted by the organisation that can affect application projects, built mostly from the information security risk analysis. It provides: the list of business domains where applications run or are used; for each domain the processes, policies and practices bearing on application use (business, project, development, risk, operational, audit and change processes; the security policy; the classified information asset inventory; development methodologies; programming language best practices; standards the organisation mandates); the application security risks these bring; the security requirements that mitigate them; and guidance for ASC development (allowed ASC attributes, their mapping to ISO/IEC 27034-5 and the allowed values, rules and dependencies per attribute). Requirements are written specifically enough to plan, design and implement ASCs, and the ASC guidance is made available to development teams in early iterations.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.