All eight ISO 31000:2018 principles hold (integrated; structured and comprehensive; customized; inclusive; dynamic; best available information; human and cultural factors; continual improvement). Two privacy points are added. First, the people whose PII is processed count as stakeholders: any real or possible harm to them belongs in the risk picture, and so does the damage such harm could do to how those people regard the organization. Second, the organization should work out what privacy norms, social values and legal expectations apply in each culture it operates in, since what privacy means varies across cultures and between individuals, and that understanding should shape how privacy risks are identified, evaluated and treated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.