Personally identifiable information is managed correctly by all stakeholders: users understand what personal information the software generates or collects and the related data flows, so they can carry out risk assessment and determine the need for data processing agreements, with ISO/IEC 27701, ISO/TS 14265 and the applicable privacy law (such as the GDPR or HIPAA) as references.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.