The subscriber checks the contractual and service governance, including how far the provider can change terms unilaterally; the renewal, exit and modification notice periods; the insurance, guarantees and penalties included and their caveats; how far the provider will expose itself to audit (a provision to audit subject to the subscriber's acceptance) and whether it is a reputable industry leader. It knows and negotiates the specific clauses on indemnification, intellectual property rights, limitation of liability and warranties. The cyber security clause requires compliance with the relevant security policies and procedures for confidentiality, integrity and availability and with regulatory and legal standards such as the PDPA, PCI DSS and MCMC requirements across jurisdictions; the subscriber reviews the provider's security and data management policies, especially on data privacy, confirms guarantees on data access, location and jurisdiction, scrutinises backup and resilience provisions, reviews data conversion and disposal on termination, and requires PII protection consistent with ISO/IEC 19086-4 and internal practice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.