Every web server carries a certificate issued by a trusted certification authority, issued for that site or group of sites and unique to it, using at least a SHA-2 algorithm, kept current with expired certificates revoked. Sites are reachable only over HTTPS using TLS version 1.2 (RFC 5246), version 1.3 (RFC 8446) or newer. Information exchanged between the server and its users is encrypted according to the entity's cryptography rules under Article 16, respecting the restrictions the IETF publishes on encryption methods in transport protocols.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.