Protect PII under the organization's authority with controls at strategic, functional and operational level that ensure integrity, confidentiality and availability against loss, destruction, unauthorized access or use, modification or disclosure, for as long as the PII exists; choose processors that provide sufficient guarantees of organizational, physical and technical controls and ensure compliance; base controls on legal requirements, security standards, systematic risk assessments per ISO 31000 and cost-benefit analysis; implement them in proportion to likelihood and severity, sensitivity, the number of principals and the context; limit access to those who need it and to the PII they need; resolve risks and vulnerabilities found by privacy risk assessments and audits; and subject the controls to periodic review in an ongoing risk management process.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.