The controller acts, or refrains from acting, so that personal data is not disclosed except in the cases the law permits, and adopts all technical and organisational procedures and the necessary standard criteria to protect the data and its confidentiality and to prevent hacking, damage, alteration or manipulation by any illegitimate means.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.