Carries ISO 31000:2018 6.4.3 into privacy risk: understand what the risk is and how large, working through uncertainty, sources, consequences, likelihood, events, scenarios, and existing controls and how well they work; qualitatively, quantitatively or both, taking in the likelihood and size of consequences, complexity and connectedness, timing and volatility, how effective current controls are, and how sensitive and confident the result is; with differing views and the quality of the information recorded for decision makers. This standard's own wording is not held. A held 2025 German practice paper on risk management for security, privacy and AI cites this standard's 6.4.3.4 for the criteria that set likelihood, which shows the clause is divided further; Annex C (impact and consequence examples) and Annex D (a template severity scale for impacts on individuals) give the two measures 6.3.4 asks the criteria to define.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.