The undertaking makes sure providers meet European and national rules and suitable ICT security standards. For critical or important functions it sets specific security requirements in the agreement and monitors them, with a risk based approach covering clearly split roles, the protection level for confidentiality, continuity, integrity and traceability, measures for data in transit, in memory and at rest such as encryption with sound key management, integration through interfaces with sound user and access management, network availability and capacity, continuity at every level of the technology chain, a documented incident management and cooperation model, risk based choices of data storage and processing locations, and monitoring of the provider's control effectiveness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.