Establish an organisation-wide risk management strategy per NIST SP 800-30 Rev 1 Chapter 2 (Fundamentals) and Chapter 3 (The Process) that (a) defines the purpose, scope, assumptions, constraints, risk tolerance, and priorities for risk assessment, (b) integrates risk assessment with the broader NIST SP 800-39 (Managing Information Security Risk) and NIST RMF (SP 800-37) processes, (c) establishes the risk assessment programme that determines frequency of assessments, triggers for ad-hoc assessments (significant change, incident, new threat intelligence), and management review cadence, (d) defines the three-tier hierarchy (Tier 1 organisation, Tier 2 mission/business process, Tier 3 information system) the organisation will use to scope assessments, (e) names the senior accountable officer (typically Risk Executive Function), the assessment owner per tier, and the maintenance owner. Capture the strategy in an approved risk management policy.
This control maps to 83 controls across 44 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 83 it maps to, and the evidence behind each claim, over MCP and REST.