Each countermeasure should be judged on how far it reduces likelihood, consequence or both, continuing until the security risk calls for no further countermeasures; the countermeasure that reaches that point counts as effective and should be recorded in the security assessment report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.