The assessor should determine the privacy safeguarding requirements that apply to the initiative: legal and regulatory requirements, contractual obligations, the organization's own policies, industry codes, the expectations of PII principals and the privacy principles of ISO/IEC 29100 (a normative reference), against which the risks are assessed and the treatment judged; the requirements become 7.4 of the report.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.