Senior accountability exists and risk decisions are delegated effectively, with system risks considered alongside other organisational risks. Achieved: senior management see key risk decisions; decision-makers understand their responsibilities within the set risk appetite; decisions are delegated and escalated to people with the skills and authority needed; and decisions are reviewed for continued validity. Not achieved indicators include unjustifiable decisions, vague risk appetite, isolated engineering and IT decisions and undifferentiated 'amber' risk ratings.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.