Rights and obligations are set out in a written agreement. For critical or important functions it covers a clear description of the services, start and end dates and notice periods, jurisdiction and governing law, financial obligations, whether and on what conditions sub-outsourcing is allowed, data storage and processing locations with notice of changes, how data stays reachable, intact, secret, private and safe, the right to monitor performance, quantitative and qualitative service levels, reporting duties including relevant internal audit reports, any mandatory insurance, business contingency plan implementation and testing, access and audit rights for the undertaking, its supervisors and appointed persons to premises, systems, data, personnel and external auditors, and prompt data recovery on the provider's insolvency, resolution or cessation of business.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.