Every identified risk to project processes and to the product should be analysed and evaluated, taking experience and historical data into account, with the assessment criteria and techniques evaluated, a qualitative analysis made and a quantitative one following wherever possible (typically probability and impact). Acceptable risk levels for the project and the means of determining when agreed levels are exceeded should be identified, and all results recorded and communicated to relevant personnel.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.