Threats to people should be assessed, treated, monitored, recorded and reported through a risk management process that top management has approved and that runs through every organisational activity, and because threats to people keep developing and new ones emerge, the process itself is changed when required.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.