ISO 31000:2018 5.3 applies, plus: top management and oversight bodies should see to it that privacy risk management becomes part of how the organization is built (its people, its processes and its technology), in a form that suits the way the organization operates. With a PIMS in place, the privacy risk process should be woven into the matching parts of that system.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.