The controller or third party must establish controls or mechanisms so that everyone involved in any phase of processing keeps the data confidential, an obligation that continues after the relationship ends.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.