The agency works from an authorisation boundary that diagrams the offering's internal services, components and devices, its connections to external services and systems, and every place federal information, data and metadata flow, consistent with the risk management framework; and because only the high baseline carries a US jurisdiction requirement for data centres, for low and moderate baselines the agency sets its own expectations on where data and resources may reside and addresses them with the provider through service level agreements or memoranda of understanding.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.