A controller or processor must, when determining the means of processing and during processing, implement appropriate security and organisational measures against unauthorised access, alteration, disclosure, accidental loss and destruction, at a level appropriate to the harm that could result and the nature of the data. The measures include pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems and services, timely restoration of availability and access after an incident, and regular testing, assessment and evaluation of their effectiveness; the Office may lay down technical standards. The controller has regard to the state of technology, cost, special risks and the nature of the data, particularly for transmission over networks, and every controller or processor takes reasonable steps to ensure its staff know and follow the security measures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.