The organisation has written policies and procedures to determine whether personal information it collects or receives is sensitive or specially protected under the governing law, or has been identified as such by the organisation that transferred it, and applies correspondingly more careful safeguards to it; an organisation that processes sensitive information without such procedures does not meet the requirement. New requirement in the updated set; Accountability Agents certify against it from 1 April 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.