CC3.1 CC3
Risk Assessment / CC3.1
Stating objectives clearly enough that risk can be judged against them
In plain English
Objectives are specified with enough clarity that the organization can identify what would threaten them. Vague goals make risk assessment meaningless.