Carries ISO 31000:2018 6.5.3 into privacy risk treatment: a plan says how and in what order the chosen options will be put in place, is folded into the organization's management plans after consulting stakeholders, and records why the options were chosen and the benefit expected, who is accountable and who carries it out, the actions, the resources and fall-backs, how performance will be measured, the constraints, what is reported and monitored, and when actions are due and finished. This standard's own wording is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.