EN 50126-2:2017 8.4.3 covers qualitative and semi-quantitative explicit risk estimation, including risk matrices; the system under consideration applies the method or requirement of this sub-clause where its safety process relies on it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.