Protection measures must be taken from the very beginning and throughout processing and comprise management measures and technical measures taken by those involved in processing, measures of competent state management agencies, investigation and procedural measures, and other measures the law prescribes (26); for basic personal data the processing party must apply those measures, develop and promulgate internal regulations on personal data protection stating the requirements to be followed under the Decree, is encouraged to apply protection standards appropriate to its field, and must check the cybersecurity of the systems, means and equipment used for processing before processing and permanently erase or destroy devices containing personal data (27).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.