The organisation sets down criteria for evaluating how significant a risk is, reflecting its values, objectives and resources, and in doing so considers the activities, functions, services and products it cannot do without and its stakeholder relationships, the legal, regulatory and contractual obligations it carries, the potential for harm to people, the views of stakeholders and the consequences it is prepared to accept. The criteria are set at the start of risk assessment but are kept under continual review for fitness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.