Management implements encryption of a type and strength commensurate with the sensitivity of the information for communications and storage, particularly credentials and sensitive transmissions, reviews the methods periodically as technology and threats evolve, decides what to encrypt from the data classification and risk assessment, hashes and salts stored passwords in files readable only with elevated privilege, and runs key management to agreed standards covering generation, distribution, storage, use, rotation, revocation and destruction of keys.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.