Describe how risks and significant changes are identified and assessed: classifying information assets (hardware, virtual systems, software) by nature, criticality and sensitivity; the roles in risk assessment; weighing what kinds of threat exist, how likely they are and what harm they could do (intentional and accidental, internal and external, known and unknown, including those from personnel and third parties with access, and to industrial control systems); vulnerabilities and control deficiencies; threat and vulnerability intelligence from sharing forums; ongoing identification of changes (new technology, regulatory, economic and physical environment, business lines, resources, acquisitions and divestitures, rapid growth, foreign operations, political climate); ad hoc assessments; and who is accountable for assessing change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.