Organizations are motivated to protect PII to protect principals' privacy, to comply with law and regulation, to practise corporate responsibility and to enhance trust; the privacy safeguarding requirements an organization must meet derive from legal and regulatory factors (4.5.1), contractual factors (4.5.2), business factors (4.5.3) and other factors such as the expectations of principals and industry guidelines (4.5.4), and should be identified through a privacy risk assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.