Contracts must be in writing and include all elements of DORA Article 30(2) and (3), plus elements on Article 1(1)(a) and other relevant law. They must give the entity rights to access information, inspect, audit and test ICT, which it exercises through its own internal audit or an appointed third party and, where appropriate, pooled audits and pooled ICT testing including TLPT with other clients of the provider, third-party certifications, and internal or third-party audit reports made available by the provider, without reducing its own ultimate responsibility.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.