Taking proportionality into account, the written notification includes at least: the start date and, where relevant, the next renewal date, the end date and both parties' notice periods; a short description of the outsourced function; a short statement of why it is considered critical or important; the CSP's name and brand, country of registration, registration number, legal entity identifier where available, registered address, contact details and parent company; the governing law and any choice of jurisdiction; the cloud deployment model, the nature of the data held and the regions or countries where it will be stored; the date of the latest criticality assessment; the date and headline results of the CSP's latest risk assessment or audit and when the next is due; the person or body that approved the arrangement; and any sub-outsourcers of material parts of the function with their countries or regions of registration, performance and data storage.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.