The organization carries out a first, high-level assessment of the cyber security risk the SUC presents, to establish the worst-case unmitigated risk if it were compromised, drawing on existing process hazard analyses, other risk assessments and the corporate risk matrix; the result feeds the partitioning and the decision in ZCR 4.1.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.