Treatment decisions follow the overall risk rating and may weigh remediation cost. Options are reduction or elimination (the provider proposes solutions or explanations that lower the risk, or justifies why it is irrelevant; enterprise risk practices cut probability or impact; failure counter-measures are planned), retention or acceptance after further consideration or provider clarification, avoidance by not adopting that provider, and transfer through cloud insurance or SLAs and warranties that shift the risk to the provider.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.