{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Risk Assessment & Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-08","description":"Analyzed risks are evaluated against the established risk criteria to determine inherent risk and whether treatment is required. Risks are prioritized based on severity, risk appetite, and organizational context to direct treatment resources and response sequencing. Prioritization outcomes and rationale are documented and communicated to risk owners.","details":{"control_category":"administrative","control_type":"preventive","domain":"Risk Assessment & Management","guidance":[],"members":[{"control_id":"31000-PR5","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"E12","coverage":"full","framework":"coso-erm","relationship":"superset_of"},{"control_id":"ID.RA-05","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"}],"statement":"Analyzed risks are evaluated against the established risk criteria to determine inherent risk and whether treatment is required. Risks are prioritized based on severity, risk appetite, and organizational context to direct treatment resources and response sequencing. Prioritization outcomes and rationale are documented and communicated to risk owners.","title":"Evaluate and prioritize risks against risk criteria","unified_id":"UC-RISK-08"},"id":"uc:UC-RISK-08","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-08","sourceIds":["coso-erm","iso-31000","nist-csf-2"],"sourceUrl":null,"title":"UC-RISK-08 — Evaluate and prioritize risks against risk criteria","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0a0070742580f23a1c2ff349153e822dde9f43340c2779ce29b38fcdac6e6659","properties":{"rationale":"Evaluating and prioritising analyzed risks against criteria to decide treatment is a core process step countering an assessment that never reaches decisions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:131eadbfec82d186462589ea7eb9d3f0905051ceea84289dd07aec7965b8842a","properties":{"control_id":"ID.RA-05","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-id-ra-05-06f9d9f0.json","targetId":"ctrl:nist-csf-2:ID.RA-05","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:29dedf612f5974c39011fefd61d892f6886d62b0af182e6092ad1a2a47a89ede","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/risk-ops-counterparty-settlement-disputes-eaf4600f.json","targetId":"risk:ops-counterparty-settlement-disputes","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31e74c4aa436ea9355311aa3824636066ba7e63911800177582121fb1a4e2209","properties":{},"sourceDetailPath":"/data/v1/records/wf-g12-547654b2.json","sourceId":"wf:G12","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:63458fbdd3c22ed1d82941d0cb253b8682ab4d75c3d287a7e1e3049d42017f97","properties":{},"sourceDetailPath":"/data/v1/records/wf-s23-42ca9e8c.json","sourceId":"wf:S23","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6611c294f5d374d376b7b0a5919c2f49fab2da7041c460211d4ab9cd48b657dd","properties":{},"sourceDetailPath":"/data/v1/records/wf-d53-e1a69743.json","sourceId":"wf:D53","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8461aa050063bfa1265d5de82cb69a2820618826d9fe77880a71eb8973821224","properties":{},"sourceDetailPath":"/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9f3f3a31fa68876023a7f851575d5cb505d144a0e01b590f0382f6be9f257362","properties":{"control_id":"31000-PR5","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr5-954d6ebe.json","targetId":"ctrl:iso-31000:31000-PR5","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:abac3d7b137540aca64508c0f0051558156203a990d066bf744db48960e5fe88","properties":{},"sourceDetailPath":"/data/v1/records/wf-g32-7729a23e.json","sourceId":"wf:G32","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ae243ab2fe7e15f86644ba813290ee70005b0bd5655d568ebb19b1b327214793","properties":{},"sourceDetailPath":"/data/v1/records/wf-g14-215df6e0.json","sourceId":"wf:G14","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b96766bca7d1b6cd077d70cbfd83135b188f63473ed0691a1dc97627391cadac","properties":{},"sourceDetailPath":"/data/v1/records/wf-g3-4c4dc6e1.json","sourceId":"wf:G3","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cc1a7329e4d403890a2da42a07dd82ad51d7989bf88fe8dedf422a690071438b","properties":{},"sourceDetailPath":"/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6bbca6e82ad95db9e5bfed418813c2d0fa620855cf05aa060034183e252e4ba","properties":{"control_id":"E12","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","sourceId":"uc:UC-RISK-08","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e12-ec851dae.json","targetId":"ctrl:coso-erm:E12","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:edeb696283039988ca14dffd4519c388d538d13cd2db6fa544fd79ba4b6c2b3b","properties":{},"sourceDetailPath":"/data/v1/records/wf-s7-e8f6281e.json","sourceId":"wf:S7","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f7107ccfc06867c20e74384f3400f48dc858a7649b9d024e3222aadf64b16781","properties":{},"sourceDetailPath":"/data/v1/records/wf-g5-873e0b12.json","sourceId":"wf:G5","targetDetailPath":"/data/v1/records/uc-uc-risk-08-5f27bebc.json","targetId":"uc:UC-RISK-08","type":"oversees"}],"schemaVersion":1}