Processing must rest on due secrecy: data are not processed or communicated for purposes other than those of collection unless another lawful basis applies, and the controller must adapt its technical and organisational measures to ensure confidentiality.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.