The residual risk of each zone and conduit is determined from the updated likelihood and impact on the corporate risk matrix: the risk that remains once existing countermeasures are in place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.