Processing by a processor must be governed by a binding contract setting out the instructions, the nature and purpose of processing, the type of data, the duration and both parties' rights and obligations, and requiring the processor to bind each person processing the data to confidentiality, delete or return all data at the end of services at the controller's direction unless the law requires retention, make available on reasonable request all information needed to demonstrate compliance, engage subcontractors only under written contracts imposing the processor's obligations, and allow and cooperate with reasonable assessments by the controller or its assessor or, alternatively, arrange an independent assessment against an accepted control standard and give the report to the controller on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.