The subscriber frames the scope of the cloud solution and from it the context and criteria: the external context (how the threat landscape is moving, progress in cloud security, regulation current and coming), the internal context (where the system ends, what it connects to, the existing local and wide area networks, corporate policy and guidelines) and the risk context (which risks are in bounds, chiefly security and privacy, with compliance optional). It agrees criteria for identifying risks, for setting risk appetite or threshold, for rating impact and for rating likelihood.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.