Carries ISO 31000:2018 6.4.2 into PII processing: find, recognise and describe the risks that could help or hinder objectives, looking at tangible and intangible sources, causes and events, threats and opportunities, weaknesses and strengths, changes in context, signs of emerging risk, the kind and value of assets, consequences, gaps in knowledge and the reliability of information, timing, and the biases and beliefs of those involved, whether or not the source is under the organization's control. This standard's own wording is not held (the contents page gives it pages 6 to 9, the longest process clause); its annexes show what it rests on: Annex A on finding the PII processing in scope, and Annex B's example privacy events (Table B.1) and their causes (Table B.2), which 6.3.4 points to for events that hit the organization.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.