Where a provider subcontracts, the licensee makes sure the provider informs it within a reasonable notice period of any new material subcontracting agreement or change to an existing one, and that the subcontractor undergoes due diligence and meets control and information security requirements suited to the nature and risks of its services. Whatever the subcontracting agreement says, the provider retains full legal liability for the cloud services the licensee acquires.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.