The organization shall identify the internal and external issues, relevant to its purpose, that bear on its capacity to get the outcomes its privacy information management system is meant to deliver. The privacy-specific step that the first edition added now stands as a requirement of its own: the organization shall establish whether it acts as a PII controller (joint controllership included), as a PII processor, or as both; where it acts as both, each role shall be established separately and given its own set of controls. Issues to weigh include the privacy laws, regulations, court and administrative rulings, contract terms and internal governance that affect how PII is processed. New to this edition, the organization shall form a view on whether climate change matters to its context.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.