Risk assessments can sit inside many processes (project, vulnerability, incident or problem management) or be done ad hoc on a particular topic, but taken together they cover every issue relevant to the organisation within the ISMS scope. They support decisions on managing the risks to the organisation's objectives and so focus on the risks and controls whose good management most improves the chance of meeting those objectives; ISO/IEC 27003 says more on the ISMS context.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.