Level 1, Basic: the organization can show that its operational processes can reach data that meet requirements and that those data are suitably secured, but it has shown no evidence of managing requirements or the way data are processed. The processes it runs are Data Processing (DQC.2) and Data Security Management (DRS.4).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.