Input: the risk criteria and the risks with levels. Action: compare levels with evaluation criteria, especially acceptance criteria. Trigger: risks are to be prioritised for treatment. Output: suggested decisions on further action. Acceptance criteria decide whether each risk can be accepted, and those that cannot are prioritised for treatment, by comparison with the criteria set at context establishment and ideally allowing for confidence in the assessment. For frequent low-consequence events the cumulative effect over a relevant period can give a truer picture than each event alone. Because a single cut-off is not always right, flexibility can be added through parameters such as the cost and effectiveness of possible controls. Levels can be confirmed by agreement between risk owners and specialists from the business and technical sides, and any gap between assessed levels and owners' perceptions is investigated to see which is closer to reality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.