The organization should have processes that keep matters confidential for every interested party, the whistleblower and anyone reported included. Without their consent, the identities of the whistleblower and of other relevant parties should go no further than those who need to know. If the law is likely to require, or has already led to, the whistleblower's identity becoming known, the whistleblower should be told in advance, and further protective steps against detriment may be needed. Whistleblowers should know when they may report confidentially or anonymously, and that the investigation may only be able to continue if they reveal who they are. Procedures should also cover what happens when confidentiality is breached or someone tries to breach it, including support for those affected and disciplinary action (the deck quotes the clause).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.