Persons processing personal data must protect that data against unauthorized processing through appropriate technical and organizational measures, proportionate to the risk and state of the art.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.