The entity must document and implement a data and system security procedure, aligned to the classification, that covers: access restrictions per classification level; a secure configuration baseline for ICT assets based on leading practice and standards, with regular checks that it is deployed; allowing only authorised software on systems and endpoints; protection against malicious code; allowing only authorised storage media, systems and endpoints to transfer and store data; for portable and private endpoints, remote management and remote wipe, security mechanisms staff or providers cannot disable, and removable media only where residual risk is within tolerance; secure deletion of data no longer needed and secure disposal of storage devices holding confidential information; data loss prevention; secure teleworking and private device use; and for assets or services run by ICT third-party providers, resilience requirements reflecting vendor recommended settings, a clear split of security roles under the entity's full responsibility, retained in-house competence, and measures for the provider's infrastructure risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.