Input: the risks as compared with the criteria. Action: prioritise the risks for treatment by their assessed levels. Trigger: the risks are to be treated. Output: prioritised risks with the scenarios leading to them. Evaluation turns the analysis into proposals on whether treatment is needed and on treatment priority by level; the criteria used take account of the organisation's objectives, contractual, legal and regulatory requirements and relevant interested parties' views, prioritisation resting mainly on the acceptance criteria.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.