Controllers and processors must use a risk, threat and vulnerability analysis methodology that considers at least the particularities of the processing, of the parties involved, and the categories and volume of data; choose state-of-the-art security measures taking into account the results of that analysis, the nature of the data, the characteristics of the parties, and the history of destruction, loss, alteration, disclosure or denial of access and of unauthorised or excessive access or communication; and continuously take the measures needed to assess, prevent, reduce, mitigate and control risks, including high risks to data subjects' rights, following the Authority's rules. The Superintendencia's guide on risk management and impact assessment (Registro Oficial 41, 19 May 2025) sets the risk management stages.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.