When deciding how to control a risk, the organisation must give priority in this order: eliminate the hazard or risk; control it at source by engineering controls or organisational measures; minimise it by designing safe work systems including administrative measures; and where collective measures cannot control the residual risk, provide an appropriate personal protective equipment programme. Controls must be established and implemented so that risks are managed to an acceptable level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.