Where sub-outsourcing of critical or important functions is allowed, the agreement states which activities are excluded, the conditions including that sub-outsourcers meet the provider's obligations on audit, access and security, that the provider stays fully accountable, a duty to inform the undertaking of significant planned changes with enough notice for a risk assessment, and the undertaking's right to object or terminate where changes would hurt the risk assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.