Articles 5 to 12: security follows seven basic principles (integral process, risk-based management, prevention, detection, response and preservation, lines of defence, continuous surveillance, periodic reassessment, differentiated responsibilities); each administration and entity has a security policy formally approved by the competent body stating its mission, regulatory framework, security roles with duties and designation, committee structure, documentation guidelines and the risks from processing personal data, developed through fifteen minimum requirements applied in proportion to risk (organisation, risk management, personnel, professionalism, access control, facilities, certified products and services, least privilege, integrity and updating, information at rest and in transit, interconnected systems, activity logging and malware detection, incidents, continuity, continual improvement).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.