Carries ISO 31000:2018 6.7 into privacy risk: the process and its results are documented and reported so they can be shared across the organization, inform decisions, improve the work and support dealings with stakeholders; how records are made, kept and handled depends on their use, their sensitivity and the context, and reporting belongs in governance. In privacy work the records can themselves hold PII or sensitive detail about harm to individuals. This standard's own wording is not held.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.