Estimate risk quantitatively, semi-quantitatively or qualitatively by probability and consequence. Consequences of both threats and opportunities may be rated high, medium or low against financial thresholds and impact on strategy, operations and stakeholder concern; probability uses separate definitions for threats (for example high as likely each year or above 25%, low as below 2% in ten years) and opportunities (high as above 75% within a year). A 3 x 3 matrix suits many organisations, a 5 x 5 others.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.