The controller must apply technical and organisational measures to default settings so that processing is limited to its intended purpose, covering the volume and type of data collected, the type of processing, the storage period and who can access the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.