Determine risk per NIST SP 800-30 Rev 1 Section 3.2 Step 6 + Appendix I (Risk Determination Tables) and perform uncertainty and sensitivity analysis per Section 3.2 Step 6 guidance. Risk is a function of the likelihood that an adverse event will occur and the impact that would result. Capture overall risk per scenario using the risk determination tables in Appendix I (Risk Level Matrix combining likelihood and impact, both rated Very Low through Very High). Uncertainty analysis must document the assumptions made (threat source characterisation, control efficacy, dependency assumptions), the data quality (high, moderate, low) underlying each likelihood and impact estimate, and the residual uncertainty. Sensitivity analysis must identify scenarios where small changes in inputs produce large changes in risk and flag them as priority for refinement. Record risk rationale, assumptions, uncertainty, and sensitivity findings in the risk register entry per scenario.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.