Develop security and privacy architectures that describe the requirements and approach for protecting the confidentiality, integrity and availability of organisational information and for processing PII with minimal privacy risk, how they integrate with the enterprise architecture, and the assumptions about and dependencies on external systems and services; review and update them at least annually or on change, and reflect planned changes in the security and privacy plans, CONOPS, criticality analysis, procedures and procurements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.