First additional provision: the Esquema Nacional de Seguridad includes the measures to prevent loss, alteration or unauthorised access to personal data, adapting risk criteria to GDPR Article 32; the public bodies listed in Article 77.1 apply the corresponding ENS measures to personal data processing and promote equivalent measures in linked private-law companies and foundations; third parties providing services by concession, delegation or contract apply measures matching the public administration and the ENS.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.