The initial risk from ZCR 2.1 is compared with the organization's tolerable risk; where it is higher than the organization will accept, a detailed risk assessment under ZCR 5 follows, and where it is not the organization may still decide one is warranted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.