The Controller implements all necessary organisational, administrative and technical measures to protect personal data, including in transfer (Law 19), limiting breach risks and following the National Cybersecurity Authority's controls, standards and rules, or recognised good practice and cybersecurity standards where it is not bound by them (IR 23).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.