Controls are ranked from highest protection and reliability to lowest: eliminate the hazard; substitute, isolate or use engineering controls; then administrative controls; then PPE. The Regulations require duty holders to work through this hierarchy for certain risks. The duty holder must always aim to eliminate the risk, and if that is not reasonably practicable must minimise it by working through the other levels. Lower levels only reduce risk because they do not remove the hazard, and administrative controls and PPE, which rely on behaviour and supervision, should be used only to supplement higher controls, as a short term interim measure, or as a last resort when nothing else is practicable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.