The report should state the privacy safeguarding requirements determined under 6.4.3 with their sources, against which the risks were assessed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.