The consequences of each threat exploiting a vulnerability are determined and their impact rated on the organization's scale (health, safety and environment, operations, finance), drawing on process hazard analyses; Annex B gives an example severity scale.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.