Consumer IoT devices shall use best-practice cryptography to protect personal data and security-sensitive data in transit; cryptographic algorithms and protocols shall be reviewed regularly. Devices shall mutually authenticate where appropriate, and credentials shall not be sent in clear over the network.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.