The organisation has reasonable administrative, technical and physical safeguards suited to its size and complexity, the nature and scope of its activities and the sensitivity of the information, such as authentication and access control, encryption, boundary protection, audit logging and monitoring through audits and vulnerability scans; it takes reasonable measures to require processors and service providers to protect the information too and periodically reviews its measures for relevance and effectiveness. Requirement 27 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.