Where the unmitigated risk exceeds tolerance, the countermeasures already in place are identified and evaluated for their effect on likelihood and impact, producing a list of countermeasures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.