Data sent over wireless connections (Wi-Fi and the like) and over wired connections beyond the controlled area is encrypted, except for metadata needed to establish the transmission; the encryption configuration is risk-based and allows for how long, and how strongly, protection is required; where possible, encryption tools carrying a positive deployment advice from the AIVD's NBV Resilience Unit are used, and if none is advised another method is chosen and configured in consultation with the CISO.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.