When evaluating the level of information security, the controller and processor must consider the risks of processing, including damage, loss, accidental or unlawful alteration and disclosure of or access to personal data in transfer, storage or processing, as well as cost and the nature, scope and purposes of processing and the potential risks to data subjects.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.