Risk management (treatment and monitoring): no Level 1 requirement. Level 2 (a to e): prioritised treatment according to defined criteria, periodic review of risk assessments and residual risks, analysis and evaluation of risks, a documented risk management strategy, and review of the effectiveness of actions taken after incidents. Level 3 prescribes a particular methodology with metrics that measure control effectiveness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.