The organization shall carry out privacy risk assessments on a planned schedule and also whenever a significant change is planned or takes place, applying the criteria set under 6.1.2, and shall keep documented evidence of what each assessment found.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.