Appropriate security controls are enabled for sensitive data, and for every sensitive data item the catalog holds evidence of those controls; the sensitivity level determines the required encryption, obfuscation and data loss prevention. Automation opportunities: provide encryption, masking, obfuscation and tokenization that switch on automatically according to the sensitivity of a data set; record the application of security controls automatically. Certification test steps: confirm the catalog exists and scanning recurs; report sensitivity-driven controls; confirm the security control definition is applied to sensitive assets and follows a change of classification; verify on random samples that the security description is accurate and the control is actually applied to the store or service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.