One document is normative: ISO/IEC 29100:2011, the privacy framework. Its principles supply the reason deletion matters, and the draft assumes the reader can use them. No other standard is binding through clause 2. A single normative reference keeps the dependency surface small. The privacy framework supplies the vocabulary of principles, and the deletion draft supplies the method that turns a retention principle into dated rules. A reader who has not read the privacy framework can still use the draft, but the justification for each rule will be thin. The two named principles answer different questions. Data minimisation asks whether the record should exist at all. Use, retention and disclosure limitation asks how long it may stay and who may see it. Deletion is the mechanism that closes the second question. The dated reference also tells an auditor which edition of the privacy framework the policy was written against. If the organisation holds a later edition, the clause still points to the dated one for this draft, and the policy can note the later edition as additional context. The bibliography is where tool and de-identification reading lives, and the draft is explicit that those topics are outside its own text. That division is useful in a review: a finding about a wipe method is a tool finding, not a finding against this draft.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.