The controller must take all measures, in the light of the nature of the data and the risks of processing, to ensure the integrity and security of the data and prevent their distortion, damage or access by unauthorised persons. Disclosure, even negligent, of processed personal data to unauthorised persons is an offence (Article 106).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.