The organisation must estimate and judge the risk level attached to each identified hazard, and the results must be taken into account when making decisions and when determining the controls to apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.