Identify threat sources and threat events per NIST SP 800-30 Rev 1 Section 3.2 Step 2 + Appendix D (Threat Sources) + Appendix E (Threat Events). Threat source types include (a) adversarial (individual, group, organisation, nation-state) with characterisation by capability, intent, and targeting, (b) accidental (privileged or non-privileged user error), (c) structural (IT equipment failure, environmental control failure, software failure), (d) environmental (natural disaster, infrastructure outage). Threat event identification must enumerate events the organisation may face, using Appendix E as a starting taxonomy and supplemented with sector-specific threat intelligence (FS-ISAC, H-ISAC, MS-ISAC, CISA advisories, MITRE ATTandCK techniques). Document the threat source register and threat event catalogue per assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.