A method is set for gathering evidence about data protection controls; evidence showing that sensitive data is protected and conforms to its classifications, handling policies and regulatory obligations is collected proactively, automatically where practicable, from IaaS, PaaS and SaaS services and custom applications; evidence is ingested, stored, processed and analyzed and linked directly to the catalog and the applicable classification; and the organization demonstrates it applies controls consistently with its risk appetite and data ethics. Classification identifies where controls are needed; activity logs, continuous compliance checks, provider APIs for logs and configurations and infrastructure-as-code templates supply evidence; misconfigured active controls are detected and corrected; and where evidence reveals exposed data, or controls that are absent or inadequate, a plan to resolve it is documented and gaps in evidence collection are closed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.