An informal textual risk analysis identifies the most valuable assets, likely threats, safeguards and main residual risks; MEDIA systems need a semi-formal analysis (R1) with a threat catalogue, qualitative asset valuation and valued residual risk; ALTA systems need a formal analysis (R2) with an internationally recognised mathematical basis and formal acceptance of residual risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.