Agencies should assess data security risks for their datasets as part of the Government ICT Risk Management Methodology, using its Data Security Risk Assessment Methodology, when acquiring a new dataset, developing an ICT system holding personal or entity data, or first using data not yet assessed, and review the assessments at the frequency set by the Government Risk Management Policy or when risk factors change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.