Provide appropriate security measures to protect users' personal data against loss, damage, disclosure, intrusion by an unauthorised party, or replacement or addition of incorrect data, proportionate to the nature and scope of activities and the sensitivity of the data collected and stored, including (1.1) processing and encrypting personal data according to the data level set by the provider's data classification policy, (1.2) ongoing confidentiality, integrity, availability and resilience of processing systems and services, (1.3) timely restoration of availability of and access to personal data after force majeure, and (1.4) testing and evaluating the effectiveness of technical and organisational measures. (In 2021 CITRA set the encryption mechanism by its own classification policy; 2024 refers to the provider's policy.)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.