Critical information infrastructure operators and handlers reaching the CAC-specified volume must store PI collected/generated in China domestically; any cross-border provision must pass a CAC security assessment unless exempted.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.