Companies shall integrate due diligence into all their relevant policies and risk management systems and have a due diligence policy ensuring risk-based due diligence, developed in prior consultation with employees and their representatives and containing a description of the company's approach to due diligence including in the long term; a code of conduct with the rules and principles to be followed throughout the company, its subsidiaries and its direct and indirect business partners under the contractual-assurance provisions; and a description of the processes that integrate due diligence into relevant policies and implement it, including the measures to verify compliance with the code and to extend the code to business partners. The policy shall be updated without undue delay after a significant change and reviewed, and where necessary updated, at least every 24 months, taking account of the impacts identified, the measures taken and the outcome of the Article 15 assessments.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.