The organization shall set up, operate, keep up and keep improving a privacy information management system, covering the processes it requires and how they interact, as this document requires. The first edition had the organization extend an ISMS built on clauses 4 to 10 of the 2013 edition of ISO/IEC 27001; the second edition asks the PIMS to satisfy this document on its own, leaving the organization free to align or combine it with an ISMS or another management system if it chooses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.