The organization's information security policies, or a separate set of privacy policies, shall declare its backing for, and commitment to, meeting the PII protection laws and regulations that bind it and the contract terms settled with partners, subcontractors and relevant third parties such as customers and suppliers, and shall divide responsibilities among them without ambiguity. Whether it acts as a controller or as a processor of PII, the organization shall take the applicable PII protection laws and regulations into account each time these policies are written or revised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.