Where relevant, the contract for processing personal data must set out how the organization will help the customer meet the customer's own obligations, having regard to what the processing involves and what information the organization holds. As applicable this covers privacy by design and by default, keeping processing secure, reporting breaches to a supervisory authority and to customers and individuals, carrying out privacy impact assessments, and guaranteed support where a data protection authority has to be consulted in advance. Some jurisdictions also require the contract to state what is processed and for how long, how and why it is processed, which kinds of data are involved and which categories of individuals are affected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.