The organization shall decide which internal and external communications the privacy information management system needs, setting for each the subject, the timing, the audience and the method. Communications about PII processing with PII principals, customers, supervisory authorities and processors, breach notification among them, are the external communications the system has to plan for, and what they say is governed by the Annex A controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.