Risk values are combined only when each is a single consequence in the same units and stated quantitatively, or on a common utility scale, and aggregation loses information about components and can mislead. The underlying assumptions are understood, correlations and dependencies sought and modelled, and the models are backed by scenarios and stress tests. Merely summing risks is not dependable. Qualitative or semi-quantitative measures cannot be aggregated directly, though a qualitative aggregation by expert opinion may be done with assumptions and information stated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.