Using the Annex D checklist, the subscriber requires the provider to maintain formal audit plans and reports and submit them on request; have independent reviews and assessments performed periodically; have technical security assessments, vulnerability assessment and penetration testing included, performed periodically on the infrastructure supporting the subscriber; update the subscriber periodically against the agreed service levels and security requirements; return and reliably erase the subscriber's data when the contract expires; disclose the geographic locations where data will be stored and processed; disclose the software and applications installed on systems holding the subscriber's data with the resulting risks and mitigations; implement input and output integrity routines such as reconciliation and edit checks on interfaces and databases; be unable to read, manipulate or delete data without the subscriber's specific consent; and follow retention norms in line with the subscriber's policies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.