The overall inherent risk level is generally the level with the most criteria rated, adjusted with documented rationale for the nature and complexity of products and services, size, business model and customer base; low, medium and high are defined by the use of emerging technology, channels, outsourcing, connections and footprint. The overall level maps to the minimum maturity the institution must attain: low to baseline, medium to intermediate, high to advanced; medium and high institutions also carry out iCAST.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.