The organisation has procedures or mechanisms to identify and assess the risk of harm to individuals from misuse of personal information in its processing, to document that assessment and to implement mitigation proportionate to the likelihood and severity of the potential harm. New requirement in the updated set; Accountability Agents certify against it from 1 April 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.