ISO/IEC 27002:2022 control 8.15 applies, with telecommunications guidance: fix a suitable retention period for telecommunications data, according to what it is kept for (accounting, billing, handling complaints, guarding against abuse, and access by authorities under the law), and once the period ends or the purpose has been met, erase the data promptly, in line with the business, legal and regulatory requirements that apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.