Control: the contract between customer and processor sets the lowest acceptable level of technical and organisational measures needed to keep the agreed security arrangements in place and keep data processing within the controller's instructions, and the processor cannot lower those measures on its own. Guidance: security and PII obligations may bind the processor directly by law; where they do not, the contract covers them. This document and ISO/IEC 27002 serve as a reference catalogue for agreeing a PII processing contract. Before signing, the processor tells a prospective customer which aspects of its services matter for PII protection and is open about its capabilities, though it remains the customer's responsibility to confirm that the measures meet its own obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.