Before engaging an external provider with access to the database the controller assesses the security risks and agrees expressly on the data and permitted purposes, the systems accessed, the permitted processing, the duration and the return, destruction and reporting at the end, how the Regulations' processor duties and any extra instructions are implemented, confidentiality undertakings by the provider's users, flow-down to subcontractors, and at least annual reporting on compliance and notice of security incidents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.