Include in the incident response plan, for breaches involving personally identifiable information, a process to decide whether individuals, other organisations or oversight bodies must be notified, an assessment of the harm, embarrassment, inconvenience or unfairness to affected individuals with mitigation mechanisms, and the applicable privacy requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.