ISO 31000:2018 5.4.1 applies, plus: an organization that handles PII, or builds products or services that do, should determine the role or roles it plays towards that processing, for example controller, joint controller or processor, or maker, software developer or supplier of products that handle PII. Knowing that role is essential to designing a framework that finds and treats privacy risk to the organization correctly. With a PIMS in place, this context should agree with the context already set for the PIMS under ISO/IEC 27701:2019, 5.2.1.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.