The controller must maintain reasonable administrative, technical and physical data security practices designed to protect confidentiality and integrity and reduce foreseeable risks of harm, appropriate to its size, scope and type and to the volume and nature of the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.