Apply Section 5 PII security controls aligned with NIST SP 800-53 PII-related controls: access control (AC family) including least privilege + role-based access + separation of duties; encryption of PII at rest (FIPS 140-3 + AES-256 + PQC migration per FIPS 203/204/205) and in transit (TLS 1.3); storage confidentiality including secure cloud + encrypted databases + tokenisation; auditing and accountability (AU family) including logging + monitoring + log retention; media protection (MP family) including secure handling + disposal + sanitisation per NIST SP 800-88.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.