Procedures are developed, implemented and maintained for the secure disposal of customer information in any format no later than two years after the last date it is used in connection with providing a product or service to the customer, unless the information is necessary for business operations or other legitimate business purposes, is required by law or regulation to be retained, or targeted disposal is not reasonably feasible because of how the information is maintained; and the data retention policy is periodically reviewed to minimise unnecessary retention.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.