Contracts include audit mechanisms and tools that confirm organisational practices are followed through the system lifecycle; retention policies applied to stored data by classification, so the provider's solution never obstructs compliance with public records law and data protection law; a clear documented process for each party's responsibilities when MCDA data is extracted and destroyed at contract end; and provision for the provider being taken over or bought out, so that the MCDA cannot lose ownership of, access to or protection for its data on a change of provider ownership.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.