The behaviors that mark out the culture the entity wants are defined. Culture mirrors the entity's core values, behaviors and decisions and can be placed along a range running from avoiding risk to seeking it aggressively, with judgment relied on to place the entity and its operating units, which may legitimately differ; culture shapes how risks are found, judged and answered at every stage from setting strategy to carrying it out, including the scope of strategic alternatives considered, the rigor of risk identification and assessment, and what is treated as risk or as opportunity; decisions and behaviors are aligned with the core values because misalignment costs stakeholder confidence and performance, and where a culture is aware of risk, people grasp the entity's values and purpose and the limits they work within, and feel able to discuss which risks to accept; and culture shifts over time with internal change and external influences, so it is monitored and deviations from standards of conduct are addressed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.