The subscriber identifies all risks arising from security and privacy threats within the scope, context and identification criteria, drawing on a wide range of stakeholders and the threat examples of Annex A, with consensus on the risk appetite for each risk; analyses them by having stakeholders set and agree impact scores and likelihood under the agreed criteria, allowing known compensating controls (Annex D) to lower impact or likelihood; and evaluates them on impact and likelihood together, considering further compensating controls and any additional risks, then shortens the list to the risks that exceed the organisation's threshold.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.