Risk assessment should focus on risk to workers (not the organisation), cover internal and external workers including support services, use the government supply chain risk methodology or equivalent, score likelihood and severity to prioritise salient risks for in-depth investigation and mitigation, consider leverage, and be continuous rather than annual.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.