Implement controls including encryption to protect Nonpublic Information held or transmitted by the Covered Entity in transit over external networks and at rest. Where encryption at rest is infeasible, CISO may approve effective alternative compensating controls, reviewed at least annually.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.