An organization works out its ethics, and the conduct it expects, from engagement with its stakeholders and from internationally recognized norms. Applied to IT, the governing body should govern IT use and make its expectations explicit so that the use of IT, and the human conduct around it, stays inside those limits and does no harm to relevant stakeholders or to the economy or the natural environment. Following the principles and applying the model and the framework to the organization's IT use is how the governing body supports and encourages ethical conduct. Expectations may address ownership of IT assets together with rights and duties over data, who may access and use what, social and environmental questions, keeping information confidential, honesty and openness in meeting obligations and commitments, and regulatory compliance.
This control maps to 13 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 13 it maps to, and the evidence behind each claim, over MCP and REST.