For each combination of data state and sensitivity level an encryption standard is set and enforced through the cloud provider's capabilities, so sensitive data is protected against disclosure, modification, misuse or attack to the level the organization accepts and regulation requires, consistently with its risk appetite and data ethics, under a key management scheme that balances risk, possible loss of function and operational complexity. The policy covers data at rest (including archives), in motion (TLS configured to current guidance, FIPS 140-2 endpoints where required, including the organization's own internal and third-party transfers), in use (risk analysis of confidential computing and compensating controls such as just-in-time privileged access, lockbox approval and SIEM monitoring) and application-level encryption. Key management options run from provider-managed through customer-managed and bring-your-own to hold-your-own keys, with role-based least-privilege access to keys, network restriction, protection against key deletion, routine and emergency rotation, and trustworthy logs of key use; key management practice at the provider and internally is reviewed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.