The controller of personal data has a formally approved and dated security document, kept up to date, containing at least the procedures for access management, privilege management and periodic verification of assigned privileges for the information systems used to process personal data (technology platforms, mobile applications, database engines and others), which may refer to the requirements and controls of NTP-ISO/IEC 27001 or a widely recognised sector standard; public entities apply the digital governance and digital security rules. Reglamento articles 46 to 58 add the controls for processing by digital means (logging, backup and recovery, environment and equipment controls, transmission, non-automated files and certain date).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.