With the assessment done, the subscriber compares the security and privacy risk levels of each candidate provider against its tolerance thresholds, shares the information with decision makers and other stakeholders, and refines the risk criteria, assessments and treatments further, now taking in cost-benefit analysis, organisational constraints and business priorities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.