The organization shall fix the boundaries and applicability of its privacy information management system to define its scope, taking into account the internal and external issues identified under 4.1, the interested party requirements from 4.2, and the points where its own activities connect with or rely on work done by other organizations. The scope shall cover the processing of PII and be kept as documented information. The first edition's note that a PIMS scope might force a revision of the information security management system scope has been dropped, since the PIMS is no longer an extension of an ISMS.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.