Input: the treatment plans. Action: risk owners approve them. Trigger: the plans need approval. Output: approved plans. Once formulated, each plan is approved by the risk owners, who also decide on accepting the residual risks against the defined acceptance criteria; the assessment results, the plan and the remaining risks are made understandable enough for owners to discharge their accountability.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.