Processing by a data processor is governed by a written contract between the processor and the controller, under which the processor processes on the controller's behalf; the controller may authorise only a processor that provides sufficient guarantees of appropriate technical and organisational measures so that processing meets the Law's requirements. The NCSA's guide on contractual provisions for processing (not held) sets the expected clauses.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.