Requirement 0037 (Part Two: Risk, section 5.2 Security Risk Management; applies to All entities; dated 31 October 2024; retained from Release 2025): A risk steward (or manager) is identified for each security risk or category of security risk, including shared risks. Security risk assessment and treatment form part of enterprise risk management; shared risks extend across entities, premises, industry, partners and jurisdictions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.