A controller (or processor engaging a sub-processor) must take reasonable measures, including a written agreement, so that the processor assists with compliance through technical and organisational measures, provides the information needed to demonstrate compliance, and notifies when it engages new processors.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.