The controller specifies in a database definitions document at least a general description of collection and use, the purposes, the types of data (by the list in the First Schedule), transfers of the database or substantial parts abroad (purpose, country, method, recipient), processing by a processor, the main security risks and their handling, and the names of the database manager, processor and Data Security Officer.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.