The institution develops, implements and maintains a comprehensive information security program, written in one or more readily accessible parts, containing administrative, technical and physical safeguards appropriate to its size and complexity, the nature and scope of its activities and the sensitivity of the customer information at issue, including the elements of 314.4 and reasonably designed to meet the rule's objectives: the security and confidentiality of customer information, protection against anticipated threats or hazards to its security or integrity, and protection against unauthorised access or use that could result in substantial harm or inconvenience to a customer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.