The processes used for the assessment, categorization and treatment of the risks identified. The Interpretation Document looks for impact assessment, attack path identification, attack feasibility or likelihood for each path, risk calculation and categorization and treatment options; unfulfilled where outputs are unusable by decision makers, mitigations are picked from a catalogue without regard to their contribution, asset inventories are incomplete or stale, or systems are assessed in isolation; fulfilled where the output is a clear set of security requirements, assets are inventoried, prioritized and kept current, and the categorization and treatment are shown to be effective and repeatable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.