Responses that remove, reduce, share, transfer or accept a risk, together with plans for taking advantage of opportunities, should where possible be founded on proven technology or on past data. Risks accepted deliberately should be identified and the reasons recorded; any proposed response should be checked to confirm it brings no unwanted effects or new risks, and the risk left over should be dealt with. Contingencies held against risk in the budget or schedule should be identified and kept separate, and risks that come from the interactions between the originating organization, the project organization and interested parties deserve particular attention.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.