Guidance that, before workforce data are gathered, the organization is taken to comply with local data-management law and any law with reach beyond its borders, and carries out due diligence, proactive and based on risk, on the ethics and business conduct of its supply chain (ISO 31000). To earn trust it is open and consistent about why data are collected, applies privacy principles to HCRD such as informed consent and collecting no more than needed, and applies security principles, among them strong data security policies, awareness of confidentiality and handling of lawful requests to share data. Those producing HCRD disclose any change from earlier years in how a metric is calculated (see 4.5.4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.