The fourth option is to do nothing and retain the risk, as an informed decision recorded by the organization, which under 4.3 owns the risk in any case; the option is acceptable only where the analysis shows the impact tolerable and the decision is taken knowingly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.