Consider sub-outsourcing risk before contracting; allow it only where the subcontractor accepts the same legal duties and access and audit rights, and ensure it does not impair confidentiality, access, audit or continuity; for material outsourcing the agreement must say whether sub-outsourcing is allowed, which activities are excluded, the conditions, the provider's oversight duty, advance notice of changes, the firm's right to object and termination for undue sub-outsourcing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.