Processing agents must adopt technical and administrative security measures able to protect personal data from unauthorised access and from accidental or unlawful destruction, loss, alteration, communication or any improper or unlawful processing; the ANPD may set minimum technical standards considering the nature of the data (especially sensitive data), the characteristics of the processing and the state of the art. These measures must be observed from the design phase of the product or service through its execution. Processing agents and anyone who intervenes in any phase of processing must guarantee the security of the information even after processing ends, and systems used for processing must be structured to meet security requirements, good practice and governance standards, the general principles and the regulations. Small processing agents may adopt a simplified information security policy with essential and necessary measures (Resolution CD/ANPD 2/2022, Arts. 12 and 13).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.