{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Risk Assessment & Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-09","description":"For each risk exceeding tolerance, a response (accept, avoid, mitigate, or share/transfer) is selected consistent with the organization's strategic risk response direction. Treatment plans with owners, actions, and timelines are formulated, approved, implemented, and tracked to completion, and residual risk is re-evaluated against tolerance. Response decisions and treatment status are communicated to stakeholders.","details":{"control_category":"administrative","control_type":"preventive","domain":"Risk Assessment & Management","guidance":[],"members":[{"control_id":"RA-7","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"31000-PR6","coverage":"full","framework":"iso-31000","relationship":"superset_of"},{"control_id":"ID.RA-06","coverage":"full","framework":"nist-csf-2","relationship":"superset_of"},{"control_id":"GV.RM-04","coverage":"partial","delta":"establishing and communicating the strategic risk-response direction itself; this UC only applies that direction during treatment selection","framework":"nist-csf-2","relationship":"intersects_with"},{"control_id":"E13","coverage":"full","framework":"coso-erm","relationship":"superset_of"}],"statement":"For each risk exceeding tolerance, a response (accept, avoid, mitigate, or share/transfer) is selected consistent with the organization's strategic risk response direction. Treatment plans with owners, actions, and timelines are formulated, approved, implemented, and tracked to completion, and residual risk is re-evaluated against tolerance. Response decisions and treatment status are communicated to stakeholders.","title":"Select, plan, and implement risk treatments","unified_id":"UC-RISK-09"},"id":"uc:UC-RISK-09","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-RISK-09","sourceIds":["coso-erm","iso-31000","nist-800-53","nist-csf-2"],"sourceUrl":null,"title":"UC-RISK-09 — Select, plan, and implement risk treatments","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2028cc99a0faefa3e71e30dcb3372dd81b608377cecc55d7e30ec0590c4f6701","properties":{},"sourceDetailPath":"/data/v1/records/wf-c6-8bc75783.json","sourceId":"wf:C6","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:20ca9fdeac78f3bd82223a0bda4382f3648081dec9c4cdfb9a1f4fb481ea7a7e","properties":{},"sourceDetailPath":"/data/v1/records/wf-g14-215df6e0.json","sourceId":"wf:G14","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2f37d65c2ed7c6fd22dd3b566c2f5d4e3e33ac092309ac097a989cb208afb2b3","properties":{},"sourceDetailPath":"/data/v1/records/wf-g4-a265153d.json","sourceId":"wf:G4","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3e56f9e5eeaafd089a9d69b62eccd785572afac4de68350d558229954e28ee50","properties":{},"sourceDetailPath":"/data/v1/records/wf-d05-2302db1f.json","sourceId":"wf:D05","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:42a4d9394bb6b7ca626460c5d5e8995f3cbb8b1ac9f75e91b807e40976ac6d0a","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-financial-liquidity-capital-e0ac2d24.json","targetId":"risk:financial-liquidity-capital","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:51bad5a1784a763c1e268a12319e2469c028207190509ebf9976c2c5ac8117f9","properties":{"rationale":"","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-compliance-client-suitability-fiduciary-2212ad74.json","targetId":"risk:compliance-client-suitability-fiduciary","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:627e6ce34d65a9b323be58f51d06dba4250acf1ed5630e28a7279684473d473f","properties":{},"sourceDetailPath":"/data/v1/records/wf-g5-873e0b12.json","sourceId":"wf:G5","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9190c372e946c8a006341905f80ee84a71a9ed49295c6f66b4cd0743a2b71981","properties":{},"sourceDetailPath":"/data/v1/records/wf-g22-87bce2d6.json","sourceId":"wf:G22","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a21077e4bec07cc3fa7adc371c05d84839954ae452369ee04848bc2a464af6ed","properties":{"rationale":"Selecting, planning and tracking risk treatments to residual-risk re-evaluation is the treat stage; operating it stops exposures being left untreated.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/risk-risk-assessment-inadequate-328128b5.json","targetId":"risk:risk-assessment-inadequate","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b68f6036ae2f9ede62ada31ef6f8febda5d76256395eaee37d94683a8f51c00c","properties":{},"sourceDetailPath":"/data/v1/records/wf-d53-e1a69743.json","sourceId":"wf:D53","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bfa04869cc2cfee65acad58a0598d370ce760f17a5489ba95eba0903b37353c7","properties":{"control_id":"GV.RM-04","coverage":"partial","delta":"establishing and communicating the strategic risk-response direction itself; this UC only applies that direction during treatment selection","framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-gv-rm-04-a64cbb61.json","targetId":"ctrl:nist-csf-2:GV.RM-04","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c28cc0dca63c7d3be5ddd5d057471fa89c4823f43ac93558efaf6c17628291d0","properties":{},"sourceDetailPath":"/data/v1/records/wf-g3-4c4dc6e1.json","sourceId":"wf:G3","targetDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","targetId":"uc:UC-RISK-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c3286b67a042b22f02f3d818a389647468d9e5e1c36d455c2e5fb50756b8a60b","properties":{"control_id":"RA-7","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-ra-7-80165765.json","targetId":"ctrl:nist-800-53:RA-7","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cd61c3b1baa3e28a7d7931c4de26b4e76b41b604b1c14be3aef00a6ea4e00b46","properties":{"control_id":"E13","coverage":"full","delta":null,"framework":"coso-erm","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-coso-erm-e13-89e2311d.json","targetId":"ctrl:coso-erm:E13","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d065c12ef0a45ebd249d4b425e63c7d1789b82e0bcef3f9ea50e63bacbd448a7","properties":{"control_id":"ID.RA-06","coverage":"full","delta":null,"framework":"nist-csf-2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2.0"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-nist-csf-2-id-ra-06-9db0effb.json","targetId":"ctrl:nist-csf-2:ID.RA-06","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ff1762d38f283946e3d7edd1baafa3f00bb0b032b46e5aca0769dea9b98ef814","properties":{"control_id":"31000-PR6","coverage":"full","delta":null,"framework":"iso-31000","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2018"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-09-06ffdff1.json","sourceId":"uc:UC-RISK-09","targetDetailPath":"/data/v1/records/ctrl-iso-31000-31000-pr6-07fe73a7.json","targetId":"ctrl:iso-31000:31000-PR6","type":"maps_to"}],"schemaVersion":1}