Where residual risk remains above tolerance, additional cyber security countermeasures are identified (the flowchart loops them back into reevaluation until no residual risk exceeds the tolerable level), producing an updated countermeasure list.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.