Encrypt all customer information held or transmitted by the institution both in transit over external networks and at rest. Where encryption is infeasible, compensating controls reviewed and approved by the Qualified Individual must be used.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.