The entity must document and implement policies, procedures, protocols and tools, based on the data classification and risk assessment, that keep data available, authentic, intact and confidential during network transmission with a way to check compliance; prevent and detect data leakage and secure transfers to and from external parties; and implement, document and regularly review confidentiality or non-disclosure arrangements for its own staff and third parties that reflect its information protection needs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.