The assessor describes the potential impact of weaknesses but does not rate risks on behalf of the assessed entity or a government agency; risk is a business matter and the authorising officer decides whether exposure is within the organisation's risk appetite.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.