The controller (and the processor as applicable) establishes administrative, physical and technical security measures, determined by the inherent risk of the data, their sensitivity, technological development and possible consequences for data subjects (and, where possible, the number of data subjects, past vulnerabilities, the data's value to an unauthorised third party and other risk factors). It must inventory personal data and processing systems, set the duties of those who process data, analyse risks, establish measures and identify those implemented, analyse the gap, prepare a work plan for missing measures, carry out reviews and audits, train personnel and keep a record of storage media, set all of this out in a security measures document, and update it on improvements, substantial changes in risk, a breach or other impact, and at least annually for sensitive data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.