A contract must govern the processor's procedures and include clear processing instructions, the nature and purpose of processing, the type of data, the duration, both parties' rights and obligations, and require the processor to bind everyone processing the data to confidentiality, delete or return all data at the end of services at the controller's direction unless law requires retention, provide on reasonable request all information needed to show compliance, allow and cooperate with reasonable assessments by the controller or its assessor, and engage subcontractors only under written contracts imposing the same requirements. A processor may instead arrange an assessment by a qualified independent assessor against an accepted control framework and give the report to the controller on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.