The controller and processor take technical and organisational measures appropriate to the risk, especially for special categories, which may include pseudonymisation and encryption and must ensure confidentiality, integrity, availability and resilience and timely restoration. For automated processing, after a risk evaluation, they implement equipment access control, data media control, storage control, user control, data access control, communication control, input control, transport control, recovery, reliability and integrity, processing control, availability control and separation of data collected for different purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.