The entity uses at least publicly trusted Organisation Validated certificates for public web traffic carrying sensitive data, and at least publicly trusted OV certificates or the Dutch government's private PKI for sensitive data in web traffic that is internal; stricter certificate requirements may follow from a risk assessment, from connection conditions or from legislation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.