The entity must flow down relevant DISP and security requirements to subcontractors handling classified information, and comply with export-control and controlled-technology obligations (Defence Trade Controls / ITAR where applicable).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.