Input: prioritised risks with the scenarios leading to them. Action: choose treatment options. Trigger: no treatment plan exists or it is incomplete. Output: prioritised risks with their chosen options. Options include avoidance (not starting or stopping the activity that creates the risk, for example closing an office in a flood zone where physical controls cannot suffice, or not collecting certain personal information at all), modification (changing likelihood or the severity of consequences), retention by informed choice, and sharing (splitting responsibility with other parties internally or externally, such as insurance), where at least one control still modifies the risk but another party implements it. Options are chosen on the assessment outcome and the expected costs and benefits, singly and alongside other controls, and prioritised by risk level, time constraints, the sequence implementations require and the evaluation outcome of 7.4; how affected parties perceive a risk, and how best to communicate with them, can also inform the choice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.