Within the SLA the subscriber understands its own security requirements and the controls and federation patterns needed, and the provider understands what it must deliver to enable them, with access control policies specified; data is encrypted in motion, at rest and in use with the algorithms and access policies specified; the SLA makes clear how data and applications are isolated between tenants; the provider proves compliance with retention law and deletion policy, including hardware erasure and destruction; the provider proves compliance with any regulation the type of data attracts; for critical data and applications the provider proactively notifies SLA breaches, outages, performance problems and security incidents; the provider proves and maintains required certifications; performance definitions are agreed and written into the statement of work or the contract; a neutral third party may be named to monitor performance; the SLA states how and when the subscriber audits the provider's systems and procedures; metrics are objectively and unambiguously defined; a machine-readable SLA is considered; and human support is available when self-service is not enough.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.