ISO 31000:2018 5.4.2 is taken over without additions. Top management and oversight bodies show and state an ongoing commitment, typically through a policy or statement that sets out the organization's objectives for risk management and covers: why risk is managed and how that ties to objectives and other policies; embedding risk management in culture; leading its integration into core activities and decisions; who holds authority, responsibility and accountability; the resources provided; how clashes between objectives are resolved; how risk is measured and reported in performance indicators; and review and improvement. The commitment is communicated inside the organization and to stakeholders.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.