Before CJI is exchanged, agencies put formal written agreements in place that specify the security controls, whatever the form of exchange (email, messaging, web services, fax, hard copy or systems that send, receive and store CJI); the agreements set out roles, responsibilities and data ownership, and where CJI is sent to or received from FBI CJIS they specify the controls and conditions of this Policy, with documentation committing both parties and with different agreements applying to CJAs and NCJAs (Appendix D gives examples).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.