Select and implement measures that modify risk: mainly control or mitigation, but also avoidance, transfer and financing (such as insurance for funding losses). Any treatment system should at least give effective and efficient operations, effective internal controls and compliance with law. Prioritise control actions by potential benefit, judging controls by effectiveness (how far they remove or reduce the risk) and cost effectiveness (cost set against the expected loss if nothing is done, with the implementation cost established accurately as the baseline). Legal compliance is not optional: understand the applicable law and implement controls to meet it, with flexibility only where the cost is wholly disproportionate. Some losses, such as uninsured costs of health, safety or environmental incidents including harm to morale and reputation, cannot be insured.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.