Where applicable the sustainability information covers own operations and the value chain, including products, services, business relationships and the supply chain. Undertakings in the value chain with no more than 1 000 employees are protected undertakings: the reporting undertaking may rely on their self-declaration unless manifestly incorrect, may not require them by contract or otherwise to provide more than the voluntary standards specify (contrary clauses are not binding), must tell them which requested information exceeds the voluntary standards and that they may decline it, and is deemed compliant on value chain information when it reports without extracting more from protected undertakings. For the first three years of reporting, where value chain information is incomplete, the undertaking explains its efforts, the reasons and its plans; afterwards it uses information obtained directly or estimates.
This control maps to 2 controls across 2 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.