A cyber threat is significant for DORA Article 18(2) where all of the following hold: if it materialised it could affect critical or important functions of the entity, or other financial entities, third-party providers, clients or counterparts; it has a high probability of materialising at the entity or others, considering the related risks including exploitable vulnerabilities, the capability and intent of threat actors as known, and the persistence of the threat and knowledge of earlier incidents; and if it materialised it could meet the critical services criterion of Article 6, the clients, counterparts and transactions threshold of Article 9(1) or the geographical spread threshold of Article 9(4). The other thresholds may also be considered where the type of threat and information available indicate they could be met.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.