Every controller must establish and maintain administrative, technical and physical security measures protecting personal data against damage, loss, alteration, destruction or unauthorised use, access or processing, never weaker than those it uses for its own information, taking into account the existing risk, the possible consequences for data subjects, the sensitivity of the data and technological development.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.