The organisation takes reasonable measures, such as contract clauses, to require processors, agents, contractors and service providers receiving personal information to protect it against loss and unauthorised access, destruction, use, modification or disclosure, including by running an information security programme proportionate to the data and services (42.a), notifying it promptly of a privacy or security breach of its customers' data (42.b) and taking immediate steps to correct the failure that caused it (42.c); it periodically reviews those measures. Requirement 35 in the 50-requirement set certified against until 31 March 2027.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.