The organization shall identify which interested parties matter to its privacy information management system, what those parties require, and which of those requirements the system will deal with. PII principals are named expressly as interested parties; others can include customers, supervisory and data protection authorities, partners, suppliers and subcontractors, and their requirements may be legal, regulatory or contractual. A note taken over from the harmonized text observes that interested parties may have climate change requirements. The definition of customer, retained from the first edition, separates the organization's customers from PII principals and from third parties.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.