This anti-pattern is present when cybersecurity risk management activities are not informed by the organisation's risk criteria (RISK-2d, RISK-3b); both practices must be at least partially implemented for it to be absent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.