At planned intervals the organization shall run internal audits that tell it whether the privacy information management system meets both the requirements the organization has set for it and the requirements of this document, and whether it is effectively put into practice and kept up.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.