The standards define two strength levels, MODERATE (targeting 128-bit security) and ADVANCED (targeting 256-bit security). Each national entity must select and implement the appropriate level according to the nature and sensitivity of what it protects, and must apply a particular level where another NCA regulation mandates it. Requirements not tied to a level apply to both. Throughout the document, algorithms and parameters are listed as accepted for one level, both, or neither.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.