ISO/IEC 27002:2022 control 5.21 applies, with telecommunications guidance: customer agreements should carry controls keeping sensitive customer data undisclosed, for example rules on releasing telephone numbers or IDs where a third party runs directory assistance; where suppliers are involved in delivering essential communications, agreements about giving them priority should hold good along the whole supply chain; where supplied components are built into the network, make sure those components keep their integrity and communication functions, watching maintenance and any call-home or fault-reporting features closely; and where a supplier's service touches sensitive information, the agreement should forbid sub-contracting that gives access without the data owner agreeing first, and the agreed protection should carry through the whole chain.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.