Regulation 7 requires physical security for database systems and media commensurate with tier. Servers must be in access-controlled rooms with monitoring. Removable media and printed outputs containing personal data must be tracked, secured, and disposed of securely. Backup media must be stored separately from primary systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.