Reuse the SMS risk matrix's five-step likelihood scale (from unheard of in the industry to frequent in the work concerned) so cyber risk is described in the company's familiar terms and aligned with enterprise risk management, supporting leadership backing. Ideally use shipping-specific threat intelligence and incident reports, for example from MTS-ISAC, NORMA Cyber or France Cyber Maritime, and examine capability, opportunity and especially intent, since zero intent makes a threat theoretical.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.