Control: contracts between the processor and each sub-contractor processing PII set minimum technical and organisational measures that satisfy the processor's own security and PII obligations, and the sub-contractor cannot lower them on its own. Guidance: sub-contractors storing backup copies are covered too (see A.8.1).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.