Extends ISO/IEC 27002:2022 8.31. If PII has to be used for testing and this cannot be avoided, a risk assessment comes first and technical and organisational measures are applied to reduce the risks it finds.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.