ISO/IEC 27002:2022 control 5.19 applies, with telecommunications guidance: before a supplier is given access to sensitive information such as PII or telephone records, the organization should make sure the supplier can protect it adequately, set out how the supplier is to handle that information in a non-disclosure or confidentiality agreement signed with it, and satisfy every applicable legal and regulatory requirement, cross-border ones included.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.