Organizations should identify privacy controls, and put them in place, so that the privacy safeguarding requirements surfaced by assessing and treating privacy risk are met, and document the controls as part of the risk assessment; controls derive from the eleven principles of clause 5 and can be drawn from ISO/IEC 27001 and 27002 with the concept correspondence of Annex A.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.