Treatment options are those of ISO 31000:2018, 6.5.2; evaluation is a prerequisite for the plan, and once legal risks are evaluated the organization must demonstrate their appropriate management or face unwanted litigation and loss. Key risk indicators, data points from operational processes, show whether a treatment option is working and are most informative in combination: contract liability against contract value by contract type or third party (how much risk is taken on to win business); the volume of executed written contracts against deals entered in the system (deals without a binding contract); product sales by salesperson against compliance training registers (exposure to conduct risk where sales staff have not completed training). Factors in choosing an option: the organization's core values, strategic objectives, legal responsibility and risk management policy; a cost-benefit analysis; stakeholders' perceptions, values, attitude to risk, tolerance and preferences; the availability and allocation of resources; a legal review of laws and contractual commitments and using contract terms to limit risk; any legal opinions obtained; how far the risk can lawfully be transferred, delegated or insured; and the organization's risk awareness and maturity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.