The controller must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, disclosure or unauthorised access, in particular where processing involves transmission over a network, and against all other unlawful processing, ensuring a level of security appropriate to the risks and the nature of the data given the state of the art and the costs. Processing without the security measures of Articles 23 and 24 is an offence (Article 58).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.