The report should describe what each threat would mean for PII principals and the level of impact estimated on the stated scale; Annex A's four severity levels, held in French and German renderings, run from negligible (at most minor inconvenience, easily overcome) through limited and significant to maximum (serious or irreversible consequences the person may not overcome), and severity is defined (3.12) as the estimated size of the potential impact on a principal's privacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.