A firm keeps a current register covering every cloud outsourcing arrangement it has, separating those for critical or important functions from the rest and with a short note of why each outsourced function does or does not count as critical or important; subject to national law it also keeps a record of terminated arrangements for an appropriate period.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.