Operate processor contracts + cross-border transfers + data processing agreements per Oregon OCPA per ORS 646A.584. Processor Contracts and Obligations must (a) bind processors via written contract per ORS 646A.584, (b) include processing instructions + duration + nature + purpose + categories of data + obligations of processor including confidentiality + assistance + breach notification + deletion or return + audit cooperation, (c) flow down to subcontractors with controller approval + (d) maintain processor inventory + ongoing monitoring. Cross-border transfer safeguards must (a) implement appropriate safeguards for international transfers + (b) align with applicable federal export controls + sanctions, (c) consider data localisation requirements in target jurisdictions, (d) align with broader corporate data flow governance. Data processing agreements must (a) be in writing with processors and where applicable joint controllers, (b) document scope + responsibilities + assistance obligations, (c) integrate with broader vendor risk management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.