The processor describes its physical, technical and administrative safeguards implementing the policy (such as authentication and access control, encryption, boundary protection, audit logging and monitoring) and periodically reviews them for relevance and effectiveness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.