Where the contract lets the CSP sub-contract a material or important function, or a material part of one, the arrangement specifies what is excluded from sub-contracting; the conditions sub-contracting must meet; that the CSP remains accountable and oversees the sub-outsourced services so every contractual obligation continues to be met; a duty on the CSP to notify the entity of intended sub-contracting or material changes, especially where they could affect its ability to perform, with a notice period long enough for the entity to assess the risk and object or approve; and the entity's right to object or a requirement for its explicit approval before sub-contracting takes effect; where the entity lacks a contractual right to reject a sub-contractor it is recommended to retain a right to terminate. The entity reviews sub-contracting relevant to a regulated activity for regulatory compliance and makes sure any sub-contractor processing its data adheres to the same requirements as the CSP.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.