The contract between customer and processor fixes the lowest acceptable level of technical and organisational measures needed to keep the agreed security in place and processing within the controller's instructions, and the processor cannot lower them on its own. 2019 guidance, not confirmed for this edition: obligations may come from law or contract; the processor tells prospective customers what in its service matters for PII protection before signing, while the customer remains responsible for judging adequacy.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.