The proposed change's impact shall also be evaluated at this stage. When the assessment finds the change low risk, or a normal process for the operator, the remaining actions shall still be assessed in the context of the operator's risk management processes and its duty to reduce risk so far as is reasonably practicable. When the consequence is high, even if the probability is low, all six actions shall be carried out. Where a change removes an existing risk control, the decision shall be written down, stating which controls were removed, why, and how the associated risks will be managed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.