Per RMAP: risk. Requirements include (a) Risk Identification including high-risk circumstances + (b) Risk Mitigation including reasonable steps + (c) supply chain risk assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.