Providers submit to regular audits by NITDA and certified third parties that validate the contractually agreed controls and check compliance with the security, data handling and localisation mandates. Providers whose workloads belong to regulated sectors or to nationally significant digital services also comply with any additional sector-specific requirements competent regulators lawfully issue, which may set higher standards for data governance, classification, localisation, cybersecurity, resilience or supervisory access but never below the guideline's minimums.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.