The organization should record every approval, authorization and sign-off decision the assessment process calls for, including authorizing any exceedance of the thresholds set under 5.7 and the final approval of the assessment's results. Points to consider include the situations that call for a management decision (a threshold exceeded, an assessment completed), who takes the decision (which can differ by decision type), and whether approval from outside is needed, for example from regulators or external interested parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.