The contract must require the processor to engage subcontractors only under a written contract obliging them to meet the processor's obligations for the data; neither controller nor processor is relieved of the liability its role carries.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.