Cost, in time and effort as well as money, is only one factor in choosing among control options. It may be considered when deciding what is reasonably practicable but cannot justify doing nothing. The greater the likelihood or extent of harm, the less weight cost should carry. If two measures give the same protection and reliability, the cheaper one may be adopted. Cost cannot justify relying only on changing behaviour when more effective controls by substitution, engineering or isolation are available.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.