Top management shall set a privacy policy that suits the organization's purpose, gives a basis for setting privacy objectives, commits the organization to meeting the requirements that apply to its processing of PII, and commits it to keep improving the privacy information management system. The policy shall exist as documented information, be made known inside the organization and, where suitable, be made accessible to interested parties. The transition documents note that a written privacy policy is now a requirement in its own right, no longer an add-on to the information security policy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.