Alternative strategies are evaluated, together with the effect each could have on the risk profile. Strategy must support the mission and vision and align with core values and risk appetite; each alternative strategy carries its own risks and opportunities, so the organization identifies and understands the implications of each, forming a risk profile per option, with effort and precision in proportion to how significant and complex the decision is and using approaches such as SWOT and scenario analysis; the selected strategy must be one that can be carried out within the risk appetite, or it is revised, an alternative chosen, or the appetite revisited; strategy is changed when it no longer creates, preserves or realizes value, or when the business context moves the entity toward the boundary of acceptable risk; and bias in strategy-setting is identified and mitigated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.