The controller or processor must ensure the security of personal data in its possession by adopting appropriate, reasonable technical measures to prevent loss, damage or destruction, and to that end must identify foreseeable risks to the personal data under its possession or control and establish and maintain safeguards against them, regularly verify that the safeguards are effectively implemented, and continually update them in response to new risks or identified deficiencies; the supervisory authority may inspect and assess these measures where it considers processing or transfer may infringe rights and privacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.