A controller using a processor must choose one giving sufficient guarantees on security and organisational measures and enter into a written contract providing that the processor acts only on the controller's instructions and is bound by the controller's security obligations. A processor that processes other than as instructed is treated as a controller for that processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.