The controller and the processor must develop and take appropriate technical and organisational measures to ensure the highest standard of information security suitable for the risks of processing, in line with best international practices and standards, including: encryption and pseudonymisation of personal data; measures ensuring ongoing confidentiality, integrity (the translation says safety), accuracy and resilience (flexibility) of processing systems and services; measures ensuring timely restoration of and access to data after a physical or technical failure; and measures for testing and evaluating the effectiveness of the security measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.