The report should list the threats identified (Annex B gives generic ones) with each one's estimated likelihood on the stated scale; Annex A's likelihood scale, held in French and German renderings, grades how readily a risk source could carry out a threat by exploiting the properties of the supporting assets, from not credibly possible, through difficult and possible, to extremely easy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.