The report should state the risk criteria used: the scales for likelihood and for level of impact (Annex A) and the criteria for evaluating and accepting risk. The quoted Brazilian adoption adds that the criteria and the method behind the analysis should be made plain and that risks are rated by likelihood and by privacy impact under the chosen method, consistent with ISO/IEC 27000, so that the assessment can be followed and repeated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.