Articles 49 and 50: controllers and processors cooperate with the Commissioner; taking into account the state of the art, cost, nature, scope, context, purposes and risks, they implement appropriate technical, organisational and staffing measures ensuring a level of security appropriate to the risk, including as appropriate pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, the ability to restore availability after an incident, and regular testing and evaluation; they take steps so that persons with access process data only on instructions; approved codes or certification may help demonstrate compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.