Risk identification asks whether the product can identify conditions that could lead to harm. A measure relates hazards identified to the hazards present or the scenarios tested. The measure covers detection, not prevention. A product may identify a risk and still fail; the property here is whether it saw it. The hazards should come from the hazard analysis, and the test should present them in the conditions where detection is hard: partial data, sensor noise, a plausible but wrong input. A detector that fires on every scenario is not discriminating, so the measure should include false positives as well as missed hazards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.