Where two or more providers collaborate to deliver an end-to-end solution, the institution remains responsible for understanding and monitoring the control environment of every servicer with access to its systems, records or resources, whether it manages them through a lead provider, which must then be contractually obliged to report control and performance concerns about any outsourced activity and whose own subcontractors' control environments must meet the institution's expectations, or through stand-alone contracts with each provider, and requires by contract that providers notify it of all subcontractor relationships.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.