Set a data management policy according to information importance and the risks of the technical environment, covering data management and storage, appropriate encryption, lifecycle management and protection of keys and certificates, and response to compromise (the CRYPTREC list is the reference); classify data and protect it according to the policy (encryption, authentication, masking, access control); set and apply procedures for protection and use of external storage media (restriction, encryption, malware scanning); manage data across its lifecycle including media disposal, secure erasure and outsourcees' acquisition, return and destruction; and set and implement backup rules by system and information importance, including isolation and protection of backups, integrity checks and restore tests, choosing backup periods and frequency with ransomware in mind and using tamper-resistant backups and storage in multiple environments or media disconnected from the internal network, since some ransomware seeks and deletes backups on the same network; clearing and settlement institutions agree data sharing with related parties to secure backup integrity where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.