Top management of an organization processing PII should establish a privacy policy that is appropriate to the organization's purpose, provides the framework for setting objectives, commits to meeting the privacy safeguarding requirements that apply and to continual improvement, is communicated within the organization and made available to interested parties, and is supported by procedures and practices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.