Risks are ranked in priority order, and that ranking is what response selection rests on. Prioritization criteria such as adaptability, complexity, velocity, persistence and recovery are established and applied so that risks with similar severity can be ranked differently; risks affecting the entity as a whole and those closest to the boundary of the risk appetite receive more priority; prioritization happens at all levels, with priorities differing between operating and entity level; and the influence of competing objectives, incentives and other bias on prioritization is resisted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.