Prioritise on the assessment results and set a risk treatment plan (avoid, reduce, accept, transfer); set procedures for exceptions and risk acceptance, with management approval when used; and report the treatment plan, including residual risk, to management regularly (or confirm that it is within the board's risk appetite).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.