Carries ISO 31000:2018 6.5.2 into privacy risk: choose options by weighing benefit against the cost and effort of putting them in place. Options include steering clear of the activity, accepting or raising risk to pursue an opportunity, taking the source away, altering likelihood or consequences, sharing the risk, and keeping it by a deliberate decision. The choice is justified on more than cost, taking in legal and other obligations, voluntary commitments and what stakeholders think and perceive; treatments are watched because they can fail or bring new risks, and the risk left over is written down and kept under review. In privacy terms the obligations include the privacy safeguarding requirements of ISO/IEC 29100 and the stakeholders include PII principals. This standard's own wording is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.