An organisation must protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks, and, since 2020, the loss of any storage medium or device on which personal data is stored; the guidelines expect administrative, physical and technical measures proportionate to the sensitivity and volume of the data and the harm from a breach, and a data intermediary carries this obligation directly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.