A controller and processor implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data in their possession or under their control, including protection against accidental or unlawful destruction, loss, misuse, alteration, unauthorised disclosure or access, taking into account the amount and sensitivity of the data, the nature, degree and likelihood of harm to a data subject from loss, disclosure or misuse, the extent of the processing, the retention period, and the availability and cost of technologies and measures relative to the size of the organisation. Measures may include pseudonymisation or other de-identification, encryption, processes ensuring the security, integrity, confidentiality, availability and resilience of processing systems and services, processes to restore availability and access in a timely manner after a physical or technical incident, periodic risk assessments of processing systems and services including transmission over electronic communications networks, regular testing, assessment and evaluation of the effectiveness of the measures against current and evolving risks, and regular updating of the measures and introduction of new ones.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.