When rating how likely each incident is at each asset, the organization should take account of the state of its physical security measures (things that block or detect entry without authority) and its operational security measures (people and procedures that do the same), as recorded in the performance review list. Likelihood is rated high where the measures put up little resistance, medium where they put up moderate resistance, and low where they put up substantial resistance; the reasoning is recorded, and any numerical scores are translated into this qualitative scale.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.