For each assessed risk the applicant determines acceptability against the criteria agreed in the PSecAC: the combination of severity and level of threat, judged in the context of the product's certification basis (the same threat condition may be acceptable for one product category and not another); acceptable risks are justified and carried to the summary with the means to keep them acceptable, unacceptable ones return to security development, and the loop iterates until every residual risk is acceptable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.