The institution assesses every control principle at and below its minimum required level (baseline only; baseline and intermediate; or all three) across the seven domains and their components (26 in 2.0), recording each as accomplished, accomplished by an effective alternative control, risk accepted formally within appetite with a mitigating measure, not accomplished, or not applicable, with a justification recorded for every alternative control, risk acceptance and exclusion; for each component it computes the percentage of attainment per level, and a level is attained only at 100 per cent of the principles at that level and every level below.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.