Every outsourcing needs a binding written agreement describing the function, assuring continuity, security, risk management and confidentiality, giving the firm and authorities access to data at any time including on the provider's insolvency, setting sub-outsourcing conditions, secure destruction of data on exit and termination rights (breach of law, data security weakness, regulator instruction). Material outsourcing agreements add dates and notice periods, financial obligations, monitoring rights, measurable service levels, breach and material-development reporting, contingency testing, cooperation with regulators, audit rights, exit assistance with a transition period, insurance and data locations. Client data must be protected under the PDPL, not shared onward without consent, and returned or destroyed on exit; VARA must be told of a data breach within the same time as any legally required notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.