Sets the minimum standard under section 37(1). Security measures must include organisational and technical measures and, where needed, physical measures; cover the identification of significant risks, prevention, detection and monitoring of threats and breaches, response and recovery; preserve confidentiality, integrity and availability in proportion to risk; and cover all components of the information systems involved. Access control must include identity proofing and authentication, authorisation of access rights, user access management, defined user responsibilities and audit trails of access, change and deletion. Staff must be made aware of policies and trained. Measures are reviewed when necessary, when technology changes or after a breach. The controller must require its processors to keep appropriate security and report breaches. Where another law sets security duties the controller follows it but not below this minimum; small businesses apply measures proportionate to their risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.