Each controller must implement appropriate technical and organisational measures, taking account of the state of technology, cost, the nature, scope, context and purposes of processing and the risks, to ensure and be able to demonstrate compliance with Part 3, including data protection policies where proportionate, reviewed and updated where necessary; adherence to an approved code of conduct under section 71A may help demonstrate compliance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.