The controller sets a written data security procedure based on the definitions document and the Regulations, binding on authorised users as far as disclosed to them on a need-to-know basis, covering physical protection, access permissions, the protective means for database systems, instructions to authorised users, the risks and how they are handled including encryption, handling of security incidents by severity and sensitivity, and portable devices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.