ISO 31000:2018 5.2 applies, plus privacy-specific leadership. For privacy to be built into enterprise risk management, top management needs working knowledge of: the privacy laws and regulations that bind the organization; what it owes individuals under privacy obligations; the ways its handling of PII can affect people; and the particular concerns, risks, weaknesses, impacts and organizational consequences that privacy and PII handling bring. Where a PIMS under ISO/IEC 27701 is in place, management should know about, and commit to, joining this privacy risk work with the relevant parts of that PIMS.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.