Management develops risk measurement processes that evaluate inherent risk and the risk of different threats and uses the results to guide the selection of mitigating controls, drawing on threat analysis tools such as event trees, attack trees, kill chains and security schemata and on a taxonomy of security events that maps threats to vulnerabilities, incorporates legal requirements, keeps measurement consistent and allows comparison across threats and controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.