ISO 31000:2018 6.3.4 applies, plus privacy guidance on criteria. The organization fixes the criteria that steer assessment results: whether measures are qualitative or quantitative, the formula or method that produces the risk level, and what management does at each level. For privacy risk the criteria should say how harm to individuals is described and quantified and how that harm feeds the organization's overall risk figure; they should also allow for privacy events that affect the organization directly without touching PII principals (Annex B lists example events in Table B.1 and their causes in Table B.2). Criteria to define include: how consequences for the organization are described and quantified; how impact on individuals' privacy is described and quantified; consequences for the organization that are good or bad; and impacts on PII principals that are good or bad. To support decisions, evaluation criteria should weigh three things against one another: the organization's opportunities; its risks (reputation, fines, litigation); and the risks to PII principals (physical, material and non-material impacts). The standard's illustration is a new use of PII that offers a business opportunity with negligible risk to individuals yet a severe reputational risk to the organization.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.