For each arrangement concerning a critical or important function the register holds at least: a reference number; the start date and, where relevant, the next renewal date, the end date and both parties' notice periods; a short description of the outsourced function and the data involved, including whether it contains personal data; a firm-assigned category reflecting the nature of the function; whether the function supports time-critical business operations; the CSP's name and brand, country of registration, registration number, legal entity identifier where available, registered address, contact details and parent company; the governing law and any choice of jurisdiction; the type of cloud service and deployment model, the nature of the data held and the regions or countries where it may be stored; the dates of the latest and next criticality assessment; the date and headline results of the CSP's latest risk assessment or audit and when the next is due; the person or body that approved the arrangement; any sub-outsourcers of critical or important functions with their countries of registration, performance and data storage; and the estimated annual budget cost.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.