The controller must identify the processors responsible for personal data protection, and must verify each processor's compliance with the instructions given to it, take the appropriate precautions to protect the personal data and monitor and follow up that compliance constantly; article 12 requires disclosure or transfer to a processor to be in line with the lawful purposes and processed under the Law, and article 13 requires the processor to notify the controller immediately of any breach of precautions or risk to the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.