Threat information is gathered from internal and external analysis and a suitable method chosen to assess risk across the whole management system at least annually; a yearly risk management plan sets staff, period, targets, method and budget; an acceptable target risk level is set, risks above it identified, and results reported to management, with acceptable risks approved by management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.