The applicant evaluates the level of threat for each threat condition, a qualitative judgement of how possible it is that the condition occurs given its threat scenarios, the security measures in place and the security environment, so that risk can be judged from the condition's severity combined with its level of threat.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.