Criteria for the significance of risk may use any characteristic of risk and can bring in matters of ethics, culture, law, society, reputation, the environment, contracts and money. Significance is often judged by comparing the magnitude of risk with thresholds around objectives to see which risks to treat first. Magnitude is rarely the only factor: sustainability, resilience, legal and ethical criteria, control effectiveness, the impact if controls fail, timing, control cost and stakeholder views also count.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.