Agencies should implement technical measures together with their complementary process measures, at the level the risk assessment indicates and on top of cybersecurity measures, following three strategies: reduce the attack surface by minimising data collection, retention, access and downloads; strengthen logging and monitoring of data transactions; and protect data so that it is unusable if extracted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.