Risk management is a proactive, planned and systematic process covering all reasonably foreseeable hazards: identify hazards, assess risks where needed, control risks by choosing and implementing the most effective measure that is reasonably practicable and keeping it effective, and review controls to confirm they work as planned. Where a risk and its controls are already well known, the formal assessment step can be skipped. How elaborate the process is depends on the size and nature of the business and on how many or how severe the risks are.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.