Once countermeasures for one threat scenario have been worked out and judged effective, the organization moves on to the following scenario, and so on until every scenario on the list has been dealt with.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.