Entities under Article 16(1) must, using the Article 30 classification, protect networks against intrusion and misuse and preserve data availability, authenticity, integrity and confidentiality by: protecting data in use, in transit and at rest; securing software, storage media, systems and endpoints used to transfer and store data; preventing and detecting unauthorised network connections and securing traffic to the internet and external links; protecting data during network transmission; securely deleting data no longer needed and securely disposing of storage devices with confidential information; and making sure teleworking and private devices do not undermine the ability to perform critical activities adequately, on time and securely.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.