Those mechanisms generally require subprocessors to follow the processor's handling instructions, restrict further subprocessing, be Global PRP-certified where used, provide self-assessments or other evidence of compliance, and allow the processor to spot check or monitor them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.