Risk management programme. Level 1 (a to e): a documented risk methodology; identification of risks from external parties; an approach covering cloud-specific threats; analysis and evaluation of risks; and risk treatment plans approved by risk owners, with corrective and preventive action. Level 2 adds specific criteria for accepting risk and treatment; Level 3 requires the programme and its risks to be reviewed quarterly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.