Identify threat sources and threat events per NIST SP 800-30 Rev 1 Section 3.2 Step 2 + Appendix D (Threat Sources) + Appendix E (Threat Events). Threat source types include (a) adversarial (individual, group, organisation, nation-state) with characterisation by capability, intent, and targeting, (b) accidental (privileged or non-privileged user error), (c) structural (IT equipment failure, environmental control failure, software failure), (d) environmental (natural disaster, infrastructure outage). Threat event identification must enumerate events the organisation may face, using Appendix E as a starting taxonomy and supplemented with sector-specific threat intelligence (FS-ISAC, H-ISAC, MS-ISAC, CISA advisories, MITRE ATTandCK techniques). Document the threat source register and threat event catalogue per assessment.
This control maps to 102 controls across 58 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 102 it maps to, and the evidence behind each claim, over MCP and REST.