Protect data from unauthorised access, change, loss and disclosure throughout processing and transfer, applying suitable security to the data operational processes use. ISO 8000-62 puts it, with Data Processing, at maturity Level 1 (Basic): at that level an organization can show that its operational processes reach data that meet requirements and that those data are suitably secured. ISO 8000-1 clause 5 treats confidentiality, integrity and availability as properties of the whole system, not of the data, which is why security appears here as a support process and not as a data quality characteristic.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.