A B/D confirms that the encryption the cloud service offers meets its cryptographic policy; protects important data with strong encryption at rest and in transit as government security requirements and business needs dictate; prefers open, proven algorithms to avoid lock-in to proprietary ones; and protects and manages keys through their lifecycle. Encryption of unclassified information on public cloud is good practice for privacy even though no regulation requires it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.