Measures protect information systems and work endpoints from viruses, worms, trojans and ransomware; anti-malware and similar programs continuously prevent and detect malware and are kept up to date with emergency updates when needed; and a response procedure limits spread and damage on infection (Standards for Securing Personal Information Article 9).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.