Processing on the controller's behalf must be governed by a binding contract setting out instructions, nature and purpose, data types, duration and each party's rights and obligations, and requiring the processor to impose confidentiality on its personnel, delete or return data at the end of services, provide information demonstrating compliance, allow and cooperate with reasonable assessments (or commission an independent assessment against an accepted control framework and share the report), and flow the same obligations down to subcontractors in writing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.