All customer information held or transmitted by the institution is protected by encryption both in transit over external networks and at rest; where the institution determines encryption is infeasible in either case, it may instead secure the information by effective alternative compensating controls reviewed and approved by the Qualified Individual.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.