An explicit risk assessment has fixed how much data loss is permissible at most and how long recovery after an incident may take at most.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.