A controller may use only processors that provide appropriate technical and organisational measures to meet the Act and protect data subjects' rights, and must bind them by contract or law setting out the subject-matter, duration, nature and purpose of processing, data types and data subject categories, and the controller's obligations. Controllers that jointly decide purposes and means are joint controllers, jointly responsible for the Act's obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.