Likelihood and impact are combined through the corporate risk matrix into the unmitigated cyber security risk of each zone and conduit, the risk present before any cyber security countermeasure.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.