Risk assessment is proportionate. For critical or important functions it weighs expected benefits and costs against significant risks, and assesses legal, ICT, compliance and reputational risk and oversight limits arising from the chosen service and deployment model, the migration, the sensitivity of the activities and data, the political stability and security of the countries involved including data protection law, law enforcement and insolvency rules, sub-outsourcing and its chain length, and overall concentration on one provider across all arrangements. It is done before contracting and repeated promptly after significant deficiencies or changes, and on renewal with a changed scope.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.