The entity must have a documented policy on encryption and cryptographic controls built on its approved data classification and ICT risk assessment, with rules for encrypting data at rest and in transit, data in use where necessary (or processing it in a separated, protected environment or by equivalent measures where encryption in use is not possible), internal network connections and traffic with external parties, and cryptographic key management. The policy must set criteria for choosing cryptographic techniques by reference to leading practice, European standards and asset classification; provide for updating or changing the cryptography in response to developments in cryptanalysis; and where the entity cannot follow leading practice, use the most reliable techniques or update its cryptography, require mitigation and monitoring measures to be adopted, recorded and explained.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.