Where a countermeasure is required or advisable, both consequence and likelihood should be considered for mitigation, the objective being to reduce the likelihood of the scenario succeeding or the harm it causes to a level at which further countermeasures are not required; countermeasures may treat (organizational or physical measures), transfer (subcontracting, physical relocation, timing) or terminate (discontinuing the activity), and where impracticality, lack of authority or other insurmountable factors force the organization to tolerate a risk, that evaluation should be documented and periodically reviewed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.