Carries ISO 31000:2018 6.4.4 into privacy risk: compare the analysis with the criteria of 6.3.4 (which weigh the organization's opportunities, its own risks and the risks to PII principals) to decide on action: leave it, look at treatment options, analyse further, keep existing controls, or revisit objectives; decide with the wider context and the real and perceived consequences for stakeholders in view; record the outcome, communicate it and confirm it at the right level. This standard's own wording is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.