The migration risk assessment should cover: (1) review of the applications inventory to find redundancies; (2) identification of data owners and key stakeholders; (3) identification of the kinds of information, active or inactive, that are processed and held; (4) identification of software and other licences, including non-transferable ones; (5) identification of access rights to transfer or cancel; (6) identifying any security enhancements or emanation control equipment; (7) consideration of short and long term reporting needs; (8) assessment of hardware and equipment to decide on redeployment or disposal; (9) finding any cloud-based services and data; and (10) retraining of users.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.