What is the generally accepted criteria for "credible information"? How could Apple have communicated better about how they reviewed or corroborated the claims

What is the generally accepted criteria for "credible information"? How could Apple have communicated better about how they reviewed or corroborated the claims given by the Hong Kong Cybersecurity and Technology Crime Bureau?