Conduct risk assessments at the three tiers defined in NIST SP 800-30 Rev 1 Section 2.3 and aligned with NIST SP 800-39 governance tiers. Tier 1 Organisational Risk Assessment evaluates strategic risks (mission impact, regulatory exposure, supply chain risk, geopolitical risk) and informs the risk management strategy. Tier 2 Mission and Business Process Risk Assessment evaluates risks to specific mission and business functions and informs enterprise architecture and information protection decisions. Tier 3 Information System Risk Assessment evaluates risks to specific information systems and supports the categorisation, control selection, and authorisation activities of the NIST RMF. Document scope, assumptions, constraints, risk tolerance, and stakeholder list per tier in the risk assessment plan before executing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.