Entities under Article 16(1) must document and implement an information security policy setting high level principles and rules to protect the confidentiality, integrity, availability and authenticity of data and of their services, and on that basis implement ICT security measures, including measures applied by ICT third-party providers, that include all measures in Articles 30 to 38.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.