Stored and transferred data and their backups, above all sensitive data, are protected by adequate encryption controls: detailed, periodically reviewed policies and procedures govern encryption keys through creation, storage, use, expiry, renewal and archiving; experts review the algorithms, key lengths and data flows for weaknesses; secret keys are generated and managed securely, for example in a hardware security module; adequate controls manage keys and digital certificates; the key management devices and other encryption tools sit on separate security networks with tightly controlled access that cannot be reached from subnets used by other customers of the provider or by its staff; and the keys used for the company's data are unique to that data and never used for other customers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.