The organization must set out and document every country and international organization that personal data may end up being sent to, including destinations that result from subcontracted processing, make that list available to customers, and consider the destinations alongside the documented basis for transfer. It should recognise that a transfer requested by law enforcement may involve countries that cannot be named beforehand, or whose naming is forbidden in order to keep an investigation confidential.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.